Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe

Overview

General Information

Sample name:SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
Analysis ID:1391082
MD5:11a2a91d1b8c9b3b0784d70a78f2da6f
SHA1:5ecb42524c51dea5e2377419f77c25ed8fedf0b2
SHA256:a57a3b08bfb8aec37a412a829baf276ce0dd2782927ccc925f4509c97680ea73
Tags:exe
Infos:

Detection

Amadey, RisePro Stealer
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Amadeys stealer DLL
Yara detected RisePro Stealer
Binary is likely a compiled AutoIt script file
Creates multiple autostart registry keys
Disable Windows Defender notifications (registry)
Disable Windows Defender real time protection (registry)
Disables Windows Defender Tamper protection
Found many strings related to Crypto-Wallets (likely being stolen)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies windows update settings
PE file contains section with special chars
PE file has nameless sections
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Enables debug privileges
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after accessing registry keys)
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Startup Folder File Write
Sleep loop found (likely to delay execution)
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe (PID: 5384 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe MD5: 11A2A91D1B8C9B3B0784D70A78F2DA6F)
    • schtasks.exe (PID: 4524 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 6848 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 6652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • jQVZ0AI5Ls1YopKhCBc3.exe (PID: 7836 cmdline: "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe" MD5: 67B659FCDDF2F8C738A12D6E482A076B)
      • chrome.exe (PID: 7884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 1668 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1936,i,1783626661732821117,8687075592315426283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 7944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 7452 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1936,i,5473178486326315563,2545621214023589303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 8348 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,6856639093823868645,7335846577343969463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 8188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
        • chrome.exe (PID: 8932 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1916,i,11065865018849172942,2521104990630376558,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • msedge.exe (PID: 8852 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com MD5: 69222B8101B0601CC6663F8381E7E00F)
        • msedge.exe (PID: 9564 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1912,i,15615417388423881991,543541311184639790,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 7024 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video MD5: 69222B8101B0601CC6663F8381E7E00F)
        • msedge.exe (PID: 9808 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1064 --field-trial-handle=2040,i,3936048782353792184,14433501436862568511,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
      • msedge.exe (PID: 7432 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com MD5: 69222B8101B0601CC6663F8381E7E00F)
      • chrome.exe (PID: 9604 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 10028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 10192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • firefox.exe (PID: 9616 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 9568 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 6188 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • schtasks.exe (PID: 9452 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 9576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 9624 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 9372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • dHERKKd2xGPyY5Ssqp_N.exe (PID: 10468 cmdline: "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe" MD5: 027F0C0AE28575127E76E80E2E91D46D)
    • 4sPiYiirBc4Eg8wqN443.exe (PID: 11020 cmdline: "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe" MD5: 64D74B4DCF40E24D3F163421AD180350)
  • MPGPH131.exe (PID: 3700 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 11A2A91D1B8C9B3B0784D70A78F2DA6F)
  • MPGPH131.exe (PID: 4300 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: 11A2A91D1B8C9B3B0784D70A78F2DA6F)
  • RageMP131.exe (PID: 7412 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 11A2A91D1B8C9B3B0784D70A78F2DA6F)
  • RageMP131.exe (PID: 8724 cmdline: "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe" MD5: 11A2A91D1B8C9B3B0784D70A78F2DA6F)
  • msedge.exe (PID: 9840 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 9640 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2072,i,1673978244121305096,9852326822399086703,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
  • firefox.exe (PID: 3392 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 8992 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2284 -prefMapHandle 1816 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc5eb95e-32b5-4e67-b0fb-c26c990538d2} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" 2000786cf10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • firefox.exe (PID: 9608 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 10328 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • MSIUpdaterV131.exe (PID: 10624 cmdline: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe MD5: 027F0C0AE28575127E76E80E2E91D46D)
  • firefox.exe (PID: 10776 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 10928 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • MSIUpdaterV131.exe (PID: 9596 cmdline: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe MD5: 027F0C0AE28575127E76E80E2E91D46D)
  • AdobeUpdaterV131.exe (PID: 9188 cmdline: "C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe" MD5: 027F0C0AE28575127E76E80E2E91D46D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
AmadeyAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\P52521B9kqdb74d8LejmrZT.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
    C:\Users\user\AppData\Local\Temp\u5VRxrmyjWYJsGnPHociwt5.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security
      C:\Users\user\AppData\Local\Temp\5QtvYXoJaghghg50zGLKyNk.zipJoeSecurity_RiseProStealerYara detected RisePro StealerJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        0000002A.00000002.2084783663.0000000000DC1000.00000040.00000001.01000000.0000000E.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
          0000002B.00000002.2091149221.00000000000E1000.00000040.00000001.01000000.0000000F.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
            00000030.00000002.2160160951.00000000000E1000.00000040.00000001.01000000.0000000F.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
              00000030.00000003.2055220279.0000000004890000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                0000002A.00000003.1921954403.00000000049C0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                  Click to see the 1 entries

                  Unpacked PEs

                  SourceRuleDescriptionAuthorStrings
                  43.2.MSIUpdaterV131.exe.e0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                    48.2.MSIUpdaterV131.exe.e0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                      42.2.dHERKKd2xGPyY5Ssqp_N.exe.dc0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security

                        Sigma Signatures

                        System Summary

                        barindex
                        Sigma detected: CurrentVersion Autorun Keys Modification
                        Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, ProcessId: 5384, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RageMP131
                        Sigma detected: Startup Folder File Write
                        Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, ProcessId: 5384, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk

                        Snort Signatures

                        ⊘No Snort rule has matched

                        Joe Sandbox Signatures

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection

                        barindex
                        Antivirus detection for URL or domain
                        Source: http://185.215.113.46/mine/plaza.exe0vAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/plaza.exejAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/well.exemaniaAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/fu.exefAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/niks.exeeidi2JNoqCa0s9_1Avira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/ladas.exe86Avira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/plaza.exebAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/plaza.exeuuAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/well.exeAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/fu.exeAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/Avira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/ladas.exe3Avira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/ladas.exeAAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/amert.exegAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/amert.exeSAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/plaza.exenuAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/ladas.exeTAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/ladas.exebAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/ladas.exe17_Avira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/plaza.exeAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/ladas.exevAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/cost/fu.exertAvira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/plaza.exe7Avira URL Cloud: Label: malware
                        Source: http://185.215.113.46/mine/plaza.exe6Avira URL Cloud: Label: malware
                        Antivirus detection for dropped file
                        Source: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                        Multi AV Scanner detection for dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeReversingLabs: Detection: 47%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\fu[1].exeReversingLabs: Detection: 21%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\fu[1].exeReversingLabs: Detection: 21%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ladas[1].exeReversingLabs: Detection: 44%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\plaza[1].exeReversingLabs: Detection: 39%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\ladas[1].exeReversingLabs: Detection: 44%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\plaza[1].exeReversingLabs: Detection: 39%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\well[1].exeReversingLabs: Detection: 35%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\fu[1].exeReversingLabs: Detection: 21%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\ladas[1].exeReversingLabs: Detection: 44%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\plaza[1].exeReversingLabs: Detection: 39%
                        Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\well[1].exeReversingLabs: Detection: 35%
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeReversingLabs: Detection: 47%
                        Source: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\6EzL3hHTS7jbM2Oz3y4V.exeReversingLabs: Detection: 21%
                        Source: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\8PXzAAoEBuHCTzP4RBWU.exeReversingLabs: Detection: 39%
                        Source: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\WWQdc6vczGf1JWs0hh6W.exeReversingLabs: Detection: 35%
                        Source: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\zFHlx6IqQx3xR1F02yH2.exeReversingLabs: Detection: 44%
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\3rOLtV34Ut0fTkzynGHi.exeReversingLabs: Detection: 39%
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\IDzOFuKIaHRpmM4TfCyF.exeReversingLabs: Detection: 44%
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\KxZFCNaRhrDevdKhe6iU.exeReversingLabs: Detection: 35%
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeReversingLabs: Detection: 21%
                        Source: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\BzN7a4ewVcXrTgzQjQz2.exeReversingLabs: Detection: 44%
                        Source: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HaJpYvk8t0RJ45fl1Ifn.exeReversingLabs: Detection: 21%
                        Source: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HhXfzERnI4EYVEjNyANc.exeReversingLabs: Detection: 39%
                        Multi AV Scanner detection for submitted file
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeReversingLabs: Detection: 47%
                        Machine Learning detection for dropped file
                        Source: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exeJoe Sandbox ML: detected
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeJoe Sandbox ML: detected
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeJoe Sandbox ML: detected
                        Machine Learning detection for sample
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeJoe Sandbox ML: detected
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A5FE20 CryptUnprotectData,CryptUnprotectData,0_2_00A5FE20
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002BFE20 CryptUnprotectData,CryptUnprotectData,6_2_002BFE20
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmp
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A4C000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,0_2_00A4C000
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B1B005 recv,FindFirstFileExW,0_2_00B1B005
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002AC000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,6_2_002AC000
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0037B005 recv,FindFirstFileExW,6_2_0037B005
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\AppData
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\AppData\Local\Temp
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\Desktop\desktop.ini
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\AppData\Local
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\Documents\desktop.ini
                        Source: firefox.exeMemory has grown: Private usage: 1MB later: 96MB
                        Source: Joe Sandbox ViewIP Address: 13.107.6.158 13.107.6.158
                        Source: Joe Sandbox ViewIP Address: 204.79.197.200 204.79.197.200
                        Source: Joe Sandbox ViewIP Address: 185.215.113.46 185.215.113.46
                        Source: Joe Sandbox ViewIP Address: 185.215.113.46 185.215.113.46
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B1B005 recv,FindFirstFileExW,0_2_00B1B005
                        Source: firefox.exe, 00000028.00000002.1887962885.00000298B6900000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com( equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2525501401.0000020021E7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2479090169.0000020021E76000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000024.00000002.1760940686.000001DF1A570000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F9EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2537031544.000002001F9EA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: .S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000022.00000002.1773334428.00000231DDDA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 0`0https://www.youtube.com --attempting-deelevationUser equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000024.00000003.1759456164.000001DF1A58C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1760940686.000001DF1A591000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 7n7https://www.facebook.com/video --attempting-deelevationUser equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8:https://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2399662965.00000200212EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2394735009.00000200212EB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8e=nssBadCert&u=https%3A//www.youtube.com/&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2530333761.00000200212EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2506437316.00000200212EB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8e=nssBadCert&u=https%3A//www.youtube.com/&c=UTF-8&d=%20@ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2529018882.000002002197A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8http://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2545471085.000002001BC3A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2549293313.000002001B95D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2559211831.000002001B82A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2530333761.00000200212D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538913962.000002001F5C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538913962.000002001F5D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com/video equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2529410708.0000020021573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2511786855.0000020020E88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2505263719.0000020021573000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2549293313.000002001B95D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2525501401.0000020021E7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2479090169.0000020021E76000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com/p equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: :https://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2447950789.0000020017D8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: @mozilla.org/network/background-file-saver;1?mode=streamlistenerhttp://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000028.00000002.1887962885.00000298B6900000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.facebook.com/video--attempting-deelevation equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000024.00000002.1760940686.000001DF1A570000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.facebook.com/videoSh equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000022.00000002.1772637061.00000231DC0C9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Program Files\Mozilla Firefox\firefox.exehttps://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000024.00000002.1760940686.000001DF1A570000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/videoC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\DefaultQh equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.comC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Defaultl equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000028.00000002.1887962885.00000298B6900000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C:\Windows\system32\C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevationC:\Program Files\Mozilla Firefox\firefox.exeWinsta0\Default equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2512492000.0000020020E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2512492000.0000020020E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2440457824.0000020021579000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2529410708.0000020021573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2398315807.0000020021579000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: Qmoz-nullprincipal:{5b8e26e2-dc46-4106-a8b1-d605d72fda69}?https://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2448027886.0000020017D80000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2529410708.0000020021573000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: about:certerror?e=nssBadCert&u=https%3A//www.youtube.com/&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2530333761.00000200212EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2399662965.00000200212EB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: e=nssBadCert&u=https%3A//www.youtube.com/&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2529018882.000002002197A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2277907438.000002001A8F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2545471085.000002001BC3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2549293313.000002001B95D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2559211831.000002001B82A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2530333761.00000200212D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538913962.000002001F5C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538913962.000002001F5D9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/video equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021E94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021E95000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021E94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021E94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2012410394.0000020019B77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021E95000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2549293313.000002001B95D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2503321768.00000200215B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2529410708.00000200215B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2398315807.00000200215B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000024.00000003.1759456164.000001DF1A58C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.1760940686.000001DF1A591000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.facebook.com/video --attempting-deelevation equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: s://www.youtube.com --attempting-deelevation equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2519173933.000002001BFDB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2510716950.0000020020EB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2535123302.0000020020EB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: tlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2538913962.000002001F5D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2515891721.000002001F5D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538913962.000002001F5E6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021E94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2540139218.000002001F5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021E95000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2535743839.0000020020E99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2511786855.0000020020E99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.comp equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2408780882.000002001F973000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.comtags________ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F9EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2537031544.000002001F9EA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: x.S........[tlsflags0x00000000]www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2512492000.0000020020E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xO^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2512492000.0000020020E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xO^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2529410708.0000020021573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2491387296.0000020021E36000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xabout:certerror?e=nssBadCert&u=https%3A//www.youtube.com/&c=UTF-8&d=%20 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xhttps://www.facebook.com equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2545471085.000002001BC3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2558878982.000002001B83D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xhttps://www.facebook.com/video equals www.facebook.com (Facebook)
                        Source: firefox.exe, 00000027.00000003.2278212608.000002001A8EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2512492000.0000020020E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xhttps://www.youtube.com equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2278212608.000002001A8EE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2512492000.0000020020E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xhttps://www.youtube.com/ equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2503321768.00000200215B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2529410708.00000200215B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2398315807.00000200215B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xhttps://www.youtube.com^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                        Source: firefox.exe, 00000027.00000003.2510716950.0000020020EB5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2535123302.0000020020EB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: xtlsflags0x00000000:www.youtube.com:443^partitionKey=%28https%2Cyoutube.com%29 equals www.youtube.com (Youtube)
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1661731813.0000000006643000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1650239381.0000000006643000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1652691922.0000000006643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe
                        Source: MPGPH131.exe, 00000006.00000003.2735491573.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2608514599.0000000000D7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe(
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exe)
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2626712828.0000000005CE9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exef
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exeger
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1650239381.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1661731813.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1652691922.0000000006631000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/fu.exert
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe12
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe13
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe17_
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe3
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe3F
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe83u
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe86
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exe9x
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exeA
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2086346307.00000000014FE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exeS1
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exeT
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exeb
                        Source: MPGPH131.exe, 00000007.00000002.2626712828.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exehvpd
                        Source: MPGPH131.exe, 00000006.00000003.2735491573.0000000000D7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exet
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1950118970.0000000006643000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/ladas.exev
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exe
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exed2
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CE9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/niks.exeeidi2JNoqCa0s9_1
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exe
                        Source: MPGPH131.exe, 00000007.00000002.2626712828.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exe1a
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exeN2
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/cost/well.exemania
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/amert.exe
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/amert.exeS
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/amert.exeau
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/amert.exeg
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe0v
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe13
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe1rv
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe6
                        Source: MPGPH131.exe, 00000006.00000003.2735491573.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2608514599.0000000000D7E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe7
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe8
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe81
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe85kuue
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe86
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exe9
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2626712828.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exeVube
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exeb
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exej
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exeman2
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exenu
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CE9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exesive.dll
                        Source: MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.46/mine/plaza.exeuu
                        Source: firefox.exe, 00000027.00000003.2505263719.0000020021573000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://accounts.google.com/
                        Source: firefox.exe, 00000027.00000003.2553308884.000002001B884000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://compose.mail.yahoo.co.jp/ym/Compose?To=%ss
                        Source: firefox.exe, 00000027.00000003.2553308884.000002001B884000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cps.root-x1.letsencrypt.org0
                        Source: firefox.exe, 00000027.00000003.2542777005.000002001BCCA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.goog/gsr1/gsr1.crl0;
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
                        Source: firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0
                        Source: firefox.exe, 00000027.00000003.2441089239.00000200212F6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
                        Source: firefox.exe, 00000027.00000003.2008257223.0000020019C8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/
                        Source: firefox.exe, 00000027.00000003.1949619169.0000020019DC9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
                        Source: firefox.exe, 00000027.00000003.2008257223.0000020019C8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
                        Source: firefox.exe, 00000027.00000003.2008257223.0000020019C8E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListener
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://json-schema.org/draft-04/schema#
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://json-schema.org/draft-06/schema#
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://json-schema.org/draft-07/schema#
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://json-schema.org/draft-07/schema#-
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B90D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/
                        Source: firefox.exe, 00000027.00000003.2278677697.000002001A854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2355399254.00000200176F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1901938072.00000200176C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2094149182.00000200176EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1905616144.00000200176AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2278677697.000002001A883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2214423557.000002001A89A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2345662599.00000200176A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2026712725.00000200176AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1905616144.00000200176C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2094149182.00000200176DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2549293313.000002001B937000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2077496755.0000020017691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2298448290.000002001739A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1905553662.00000200176F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1899966098.00000200176D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2024819623.00000200176EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1899211633.00000200176D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2281683178.0000020019DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1993999431.000002001A883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1991165924.000002001A8AD000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
                        Source: firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog
                        Source: firefox.exe, 00000027.00000003.2542777005.000002001BCCA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gsr10)
                        Source: firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.goog/gts1c301
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
                        Source: firefox.exe, 00000027.00000003.2542777005.000002001BCCA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/gsr1/gsr1.crt02
                        Source: firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pki.goog/repo/certs/gts1c3.der0
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://poczta.interia.pl/mh/?mailto=%sw
                        Source: firefox.exe, 00000027.00000003.2545987773.000002001BC15000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.i.lencr.org/0
                        Source: firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2531685400.0000020021289000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.i.lencr.org/0W
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F9A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2535743839.0000020020E99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2537031544.000002001F9A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2511786855.0000020020E99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.o.lencr.org
                        Source: firefox.exe, 00000027.00000003.2535743839.0000020020E99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2511786855.0000020020E99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.o.lencr.org/
                        Source: firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2545987773.000002001BC15000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2531685400.0000020021289000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://r3.o.lencr.org0
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://win.mail.ru/cgi-bin/sentmsg?mailto=%sy
                        Source: firefox.exe, 0000002E.00000003.2739730282.0000026D26D18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                        Source: firefox.exe, 00000029.00000003.2674811397.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2668913323.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2647414793.000002880C48B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2689777330.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2692565844.000002880C48E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                        Source: firefox.exe, 00000029.00000003.2674811397.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2668913323.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2647414793.000002880C48B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersl-n
                        Source: firefox.exe, 0000002E.00000003.2744790050.0000026D26D19000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.2739730282.0000026D26D18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comTTF
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.inbox.lv/rfc2368/?value=%su
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.com0
                        Source: firefox.exe, 0000002E.00000003.2098306180.0000026D26FBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.2032879779.0000026D26FBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.2553038918.0000026D26FCB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
                        Source: firefox.exe, 00000029.00000003.2026050058.000002880BFB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul4e
                        Source: firefox.exe, 00000029.00000003.2026050058.000002880BFB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulQj
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1484666355.0000000005340000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1532755673.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2765452640.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.1533495347.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2549739564.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1636124507.0000000005320000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1887520841.00000000008C1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000014.00000003.1843238183.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2088902875.00000000008C1000.00000040.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.winimage.com/zLibDll
                        Source: firefox.exe, 00000027.00000003.2447950789.0000020017D8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com
                        Source: firefox.exe, 00000027.00000003.2529018882.000002002197A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.youtube.com/
                        Source: firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2545471085.000002001BC3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2531685400.0000020021289000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                        Source: firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2545471085.000002001BC3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2531685400.0000020021289000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                        Source: firefox.exe, 00000027.00000003.2553308884.000002001B8D8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
                        Source: firefox.exe, 00000027.00000003.1883235512.0000020017300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888767017.000002001753A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889124800.0000020017557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889563330.0000020017573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638857933.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1608053754.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1598861889.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638775970.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1637417280.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1597873882.0000000000D79000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                        Source: firefox.exe, 00000027.00000003.2559211831.000002001B820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1989729068.000002001A8E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
                        Source: firefox.exe, 00000027.00000003.2503321768.00000200215D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2529410708.00000200215D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2398315807.00000200215D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2440457824.00000200215D7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.firefox.comK
                        Source: firefox.exe, 0000002C.00000002.1926569196.000001DEAF620000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
                        Source: firefox.exe, 0000002C.00000002.1926569196.000001DEAF620000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com--attempting-deelevation
                        Source: firefox.exe, 00000027.00000003.2511786855.0000020020E99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B98C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2511786855.0000020020E88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2461439392.00000200219F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2495701203.00000200219F0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com/https://accounts.google.com/
                        Source: jQVZ0AI5Ls1YopKhCBc3.exe, 0000000B.00000002.2765450458.00000000001F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.1816315056.000001CAC95D0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.comC:
                        Source: firefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2239968674.00000200159DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2447950789.0000020017D8C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4040738/cookie_autodelete-3.8.2.xpi
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4129240/privacy_badger17-2023.6.23.xpi
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpi
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/downloads/file/4141092/facebook_container-2.3.11.xpihttps://addon
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/506/506646-64.png?modified=mcrushed(browserSetting
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushed
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushedLe
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956(browserSetting
                        Source: firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
                        Source: firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&ci=1707763558474.12791&key=1707763558400900
                        Source: firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1707763558474.12791&key=1707763558400900002.1&cta
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638857933.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1608053754.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1598861889.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638775970.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1637417280.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1597873882.0000000000D79000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638857933.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1608053754.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1598861889.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638775970.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1637417280.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1597873882.0000000000D79000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638857933.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1608053754.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1598861889.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638775970.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1637417280.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1597873882.0000000000D79000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                        Source: firefox.exe, 00000027.00000003.1883235512.0000020017300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888767017.000002001753A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889124800.0000020017557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889563330.0000020017573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
                        Source: firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpgThi
                        Source: firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/Itd_9Uful1tVwaV4hW73oqSvUYC6Gf8RNa3yg9HsqRE.3951.jpg
                        Source: firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpgA
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTab
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCapture
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryption
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsing
                        Source: firefox.exe, 00000027.00000003.2558878982.000002001B83D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%sz
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%szw
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
                        Source: firefox.exe, 00000027.00000003.2403028281.000002001F828000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2416872043.000002001F823000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
                        Source: firefox.exe, 00000027.00000003.2401787867.000002001BEE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2412407578.000002001BEB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
                        Source: firefox.exe, 00000029.00000003.2031086545.000002880BBBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1
                        Source: firefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com
                        Source: firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
                        Source: firefox.exe, 00000027.00000003.2440457824.00000200215B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
                        Source: firefox.exe, 00000027.00000003.2545471085.000002001BC2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/cfworker
                        Source: firefox.exe, 00000027.00000003.2383860555.000002002136F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
                        Source: firefox.exe, 00000027.00000003.2383860555.000002002136F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
                        Source: firefox.exe, 00000027.00000003.1883235512.0000020017300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888767017.000002001753A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889124800.0000020017557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889563330.0000020017573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F9A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2537031544.000002001F9A2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
                        Source: firefox.exe, 00000029.00000003.2031086545.000002880BBBF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
                        Source: firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Zbr4ZHZ4CDa4pbW1CbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/
                        Source: RageMP131.exe, 00000014.00000002.2099369510.00000000013E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/Fi
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/Mozilla/5.0
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1484666355.0000000005340000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1532755673.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2765452640.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.1533495347.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2549739564.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1636124507.0000000005320000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1887520841.00000000008C1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000014.00000003.1843238183.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2088902875.00000000008C1000.00000040.00000001.01000000.00000006.sdmpString found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000154F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/i
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000150E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/s
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2560943444.0000000000C90000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1939358806.000000000154F000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2099369510.00000000013E8000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.74
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000154F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.74k
                        Source: RageMP131.exe, 00000014.00000002.2099369510.00000000013E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io/widget/demo/81.181.57.74n
                        Source: RageMP131.exe, 00000014.00000002.2099369510.00000000013E8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.74
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.74P
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ipinfo.io:443/widget/demo/81.181.57.74X9
                        Source: firefox.exe, 00000027.00000003.2549293313.000002001B937000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema.
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema./
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schemaresource://gre/modules/JsonSchema.sys.mjs
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2020-12/schema
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2020-12/schema/
                        Source: firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2020-12/schemaInstance
                        Source: firefox.exe, 00000027.00000003.2559211831.000002001B820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1989729068.000002001A8E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                        Source: firefox.exe, 00000027.00000003.2559211831.000002001B820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1989729068.000002001A8E1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%sv
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%st
                        Source: firefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2240336859.00000200159C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
                        Source: firefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%sx
                        Source: firefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com
                        Source: firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
                        Source: firefox.exe, 00000027.00000003.2240336859.00000200159C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.compd
                        Source: firefox.exe, 00000027.00000003.2440457824.00000200215B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
                        Source: firefox.exe, 00000027.00000003.2507147692.00000200212A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com
                        Source: firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/
                        Source: firefox.exe, 00000027.00000003.2491387296.0000020021E48000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#l
                        Source: firefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2501812741.0000020021912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2240336859.00000200159C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
                        Source: firefox.exe, 00000027.00000003.2401787867.000002001BEE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2412407578.000002001BEB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-def
                        Source: firefox.exe, 00000027.00000003.2401787867.000002001BEE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2412407578.000002001BEB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=spotlight
                        Source: firefox.exe, 00000027.00000003.1952540052.0000020019CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2115706194.0000020019CEE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2008257223.0000020019CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2228321706.0000020019CEE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000D5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windows
                        Source: firefox.exe, 00000027.00000003.2277107716.000002001AECB000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000150E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/RiseProSUPPORT
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_bot
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botRomaniaG2
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botY2
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/risepro_botisepro_bot
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net
                        Source: firefox.exe, 00000027.00000003.2529018882.000002002197A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/ads-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/analytics-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/base-cryptomining-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/base-email-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/base-fingerprinting-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/content-email-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/content-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/google-trackwhite-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2538913962.000002001F5D3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/mozplugin-block-digest256/1604686195
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/mozstd-trackwhite-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/social-track-digest256/118.0/1693227274
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/social-tracking-protection-facebook-digest256/118.0/1693
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/social-tracking-protection-linkedin-digest256/118.0/1693
                        Source: firefox.exe, 00000027.00000003.2546355697.000002001B9F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tracking-protection.cdn.mozilla.net/social-tracking-protection-twitter-digest256/118.0/16932
                        Source: firefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2240336859.00000200159C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://truecolors.firefox.com
                        Source: firefox.exe, 00000027.00000003.2507147692.00000200212A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
                        Source: firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
                        Source: firefox.exe, 00000027.00000003.2507147692.00000200212A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
                        Source: firefox.exe, 00000027.00000003.2540139218.000002001F5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2461439392.00000200219F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2515891721.000002001F5A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2495701203.00000200219F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_da35efdf7fb6b20d4be6a53f3a5c7579d215346ca6420c02
                        Source: firefox.exe, 00000027.00000003.1911985701.00000200139B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
                        Source: firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
                        Source: firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
                        Source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                        Source: firefox.exe, 00000027.00000003.2560000631.000002001B2DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638857933.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1608053754.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1598861889.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638775970.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1637417280.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1597873882.0000000000D79000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                        Source: firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2461439392.00000200219F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2495701203.00000200219F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2512492000.0000020020E4B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
                        Source: firefox.exe, 00000027.00000003.2532168987.000002002126D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                        Source: firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search
                        Source: firefox.exe, 00000027.00000003.1883235512.0000020017300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888767017.000002001753A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889124800.0000020017557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889563330.0000020017573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                        Source: firefox.exe, 00000027.00000003.1911985701.00000200139B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
                        Source: firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.groupon.com/?utm_source=google&utm_medium=cpc&utm_campaign=us_dt_sea_ggl_txt_smp_sr_cbp_
                        Source: firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
                        Source: firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
                        Source: firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
                        Source: firefox.exe, 00000027.00000003.2553308884.000002001B8E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2530333761.00000200212D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2501812741.0000020021912000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2506437316.00000200212D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2394735009.00000200212D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2506437316.00000200212D7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2441089239.00000200212CE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
                        Source: firefox.exe, 00000027.00000003.2549293313.000002001B937000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000D5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000D5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000D5B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                        Source: firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/mobile/get-app/?utm_medium=firefox-desktop&utm_source=onboarding-mod
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2475835774.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/V
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/eware3
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1594912347.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1598136009.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1578119925.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1650239381.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1593050843.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1593804226.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1661731813.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1674131667.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1598652884.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1595881025.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.2041161160.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1599464044.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1592113511.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1957495064.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1590148708.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607892653.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1597059747.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1811506898.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607245468.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1591362920.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1602528714.0000000006631000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                        Source: firefox.exe, 00000027.00000003.1952540052.0000020019CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2008257223.0000020019CE1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
                        Source: firefox.exe, 00000027.00000003.2511786855.0000020020E99000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
                        Source: firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
                        Source: firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com
                        Source: firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com(
                        Source: firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
                        Source: firefox.exe, 00000027.00000003.2393281421.0000020021E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2525501401.0000020021E7D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2479090169.0000020021E76000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021E76000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/p
                        Source: firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.comC:
                        Source: firefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
                        Source: firefox.exe, 00000027.00000003.2532823304.00000200211D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2507147692.00000200212A6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://youtube.com

                        System Summary

                        barindex
                        Binary is likely a compiled AutoIt script file
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.2039399612.0000000006E85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_e3a10f8b-7
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.2039399612.0000000006E85000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_99319674-b
                        Source: MPGPH131.exe, 00000006.00000003.2382855663.0000000006A11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_6c4cfffb-8
                        Source: MPGPH131.exe, 00000006.00000003.2382855663.0000000006A11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_4de99616-c
                        Source: MPGPH131.exe, 00000007.00000003.2507254460.00000000063CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_222d6919-c
                        Source: MPGPH131.exe, 00000007.00000003.2507254460.00000000063CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_cbf16adc-2
                        Source: jQVZ0AI5Ls1YopKhCBc3.exe, 0000000B.00000000.1665997434.0000000000932000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_196ca8d9-7
                        Source: jQVZ0AI5Ls1YopKhCBc3.exe, 0000000B.00000000.1665997434.0000000000932000.00000002.00000001.01000000.00000008.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_cde2b0cd-5
                        PE file contains section with special chars
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name:
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name: .idata
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name:
                        Source: RageMP131.exe.0.drStatic PE information: section name:
                        Source: RageMP131.exe.0.drStatic PE information: section name: .idata
                        Source: RageMP131.exe.0.drStatic PE information: section name:
                        Source: MPGPH131.exe.0.drStatic PE information: section name:
                        Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
                        Source: MPGPH131.exe.0.drStatic PE information: section name:
                        Source: EdgeMS131.exe.0.drStatic PE information: section name:
                        Source: EdgeMS131.exe.0.drStatic PE information: section name: .idata
                        Source: EdgeMS131.exe.0.drStatic PE information: section name:
                        Source: ladas[1].exe.0.drStatic PE information: section name:
                        Source: ladas[1].exe.0.drStatic PE information: section name: .idata
                        Source: ladas[1].exe.0.drStatic PE information: section name:
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name:
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name: .idata
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name:
                        Source: niks[1].exe.0.drStatic PE information: section name:
                        Source: niks[1].exe.0.drStatic PE information: section name: .idata
                        Source: niks[1].exe.0.drStatic PE information: section name:
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name:
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name: .idata
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name:
                        Source: amert[1].exe.0.drStatic PE information: section name:
                        Source: amert[1].exe.0.drStatic PE information: section name: .idata
                        Source: amert[1].exe.0.drStatic PE information: section name:
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name:
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name: .idata
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name:
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: .idata
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: .idata
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: amert[1].exe.6.drStatic PE information: section name:
                        Source: amert[1].exe.6.drStatic PE information: section name: .idata
                        Source: amert[1].exe.6.drStatic PE information: section name:
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name:
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name: .idata
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name:
                        Source: niks[1].exe.6.drStatic PE information: section name:
                        Source: niks[1].exe.6.drStatic PE information: section name: .idata
                        Source: niks[1].exe.6.drStatic PE information: section name:
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name:
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name: .idata
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name:
                        Source: ladas[1].exe.6.drStatic PE information: section name:
                        Source: ladas[1].exe.6.drStatic PE information: section name: .idata
                        Source: ladas[1].exe.6.drStatic PE information: section name:
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name:
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name: .idata
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name:
                        Source: niks[1].exe.7.drStatic PE information: section name:
                        Source: niks[1].exe.7.drStatic PE information: section name: .idata
                        Source: niks[1].exe.7.drStatic PE information: section name:
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name:
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name: .idata
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name:
                        Source: ladas[1].exe.7.drStatic PE information: section name:
                        Source: ladas[1].exe.7.drStatic PE information: section name: .idata
                        Source: ladas[1].exe.7.drStatic PE information: section name:
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name:
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name: .idata
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name:
                        Source: amert[1].exe.7.drStatic PE information: section name:
                        Source: amert[1].exe.7.drStatic PE information: section name: .idata
                        Source: amert[1].exe.7.drStatic PE information: section name:
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name:
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name: .idata
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name:
                        Source: explorgu.exe.42.drStatic PE information: section name:
                        Source: explorgu.exe.42.drStatic PE information: section name: .idata
                        Source: explorgu.exe.42.drStatic PE information: section name:
                        PE file has nameless sections
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002AA400 NtQuerySystemInformation,HeapFree,RtlFreeHeap,RtlAllocateHeap,NtQuerySystemInformation,HeapFree,6_2_002AA400
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002AA720 NtDuplicateObject,CreateThread,RtlUnicodeStringToAnsiString,TerminateThread,6_2_002AA720
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile created: C:\Windows\Tasks\explorgu.job
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A4F0000_2_00A4F000
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A680700_2_00A68070
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A7D8400_2_00A7D840
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A768400_2_00A76840
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A7A9A00_2_00A7A9A0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A779000_2_00A77900
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A6D9700_2_00A6D970
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A822B00_2_00A822B0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A642300_2_00A64230
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B2922D0_2_00B2922D
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A6A2600_2_00A6A260
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A703900_2_00A70390
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A743E00_2_00A743E0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A70B100_2_00A70B10
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A513700_2_00A51370
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A824F00_2_00A824F0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B1A4500_2_00B1A450
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A655900_2_00A65590
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A8DDF00_2_00A8DDF0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A9CDC00_2_00A9CDC0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A505300_2_00A50530
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A6B5600_2_00A6B560
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A935500_2_00A93550
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A94EF00_2_00A94EF0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A62ED00_2_00A62ED0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A806000_2_00A80600
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A92F900_2_00A92F90
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A97F200_2_00A97F20
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A78F300_2_00A78F30
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00ABF0A00_2_00ABF0A0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00ACB8000_2_00ACB800
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00AC48700_2_00AC4870
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00ACD0700_2_00ACD070
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A420500_2_00A42050
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00ACD9B00_2_00ACD9B0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A9A1800_2_00A9A180
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A5A1000_2_00A5A100
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A422C00_2_00A422C0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B203A00_2_00B203A0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B23B280_2_00B23B28
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00AC0B100_2_00AC0B10
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A4AB500_2_00A4AB50
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00AB04200_2_00AB0420
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00AC15900_2_00AC1590
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A6FDC00_2_00A6FDC0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B2956F0_2_00B2956F
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00AD1EA00_2_00AD1EA0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B3CE310_2_00B3CE31
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A4A7200_2_00A4A720
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002C80706_2_002C8070
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002D68406_2_002D6840
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002D79006_2_002D7900
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002CD9706_2_002CD970
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002DA9A06_2_002DA9A0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002C42306_2_002C4230
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002CA2606_2_002CA260
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002D0AB06_2_002D0AB0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002AAB506_2_002AAB50
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002D03906_2_002D0390
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002D43E06_2_002D43E0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0037A4506_2_0037A450
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002CB5606_2_002CB560
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002C55906_2_002C5590
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002C05E06_2_002C05E0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002EDDF06_2_002EDDF0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002E06006_2_002E0600
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002AA7206_2_002AA720
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002D8F306_2_002D8F30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002F2F906_2_002F2F90
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0032B8006_2_0032B800
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_003BE0046_2_003BE004
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_003248706_2_00324870
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0032D0706_2_0032D070
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_003BE0746_2_003BE074
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002A20506_2_002A2050
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0031F0A06_2_0031F0A0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002BA1006_2_002BA100
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0032D9B06_2_0032D9B0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002A22C06_2_002A22C0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_00383B286_2_00383B28
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_00320B106_2_00320B10
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_003803A06_2_003803A0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_003103806_2_00310380
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0038956F6_2_0038956F
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_00311D406_2_00311D40
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_003215906_2_00321590
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002CFDC06_2_002CFDC0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_00331EA06_2_00331EA0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: String function: 003098D0 appears 32 times
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: String function: 00AA98D0 appears 36 times
                        Source: ladas[1].exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                        Source: ladas[1].exe.6.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                        Source: ladas[1].exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                        Source: well[1].exe.6.drStatic PE information: No import functions for PE file found
                        Source: well[1].exe.6.drStatic PE information: Data appended to the last section found
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameAy3Info.exe0 vs SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1512235538.00000000057DC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAy3Info.exe0 vs SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1511511560.00000000057D3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameAy3Info.exe0 vs SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: devobj.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: webio.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: vaultcli.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: dpapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: propsys.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: edputil.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: appresolver.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: bcp47langs.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: slc.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: sppc.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: linkinfo.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: ntshrui.dllJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSection loaded: cscapi.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dpapi.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: propsys.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: edputil.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: appresolver.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: bcp47langs.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: slc.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sppc.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winmm.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sspicli.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winhttp.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wininet.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mswsock.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: devobj.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: webio.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iphlpapi.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: winnsi.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dnsapi.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rasadhlp.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: fwpuclnt.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: schannel.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: mskeyprotect.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntasn1.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncrypt.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ncryptsslp.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: msasn1.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptsp.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: rsaenh.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: cryptbase.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: gpapi.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: vaultcli.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.storage.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wldp.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ntmarta.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: dpapi.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: iertutil.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: profapi.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: kernel.appcore.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: urlmon.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: srvcli.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: netutils.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: uxtheme.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: propsys.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: edputil.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: windows.staterepositoryps.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: wintypes.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: appresolver.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: bcp47langs.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: slc.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: userenv.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: sppc.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecorecommonproxystub.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: onecoreuapcommonproxystub.dll
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: webio.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: iphlpapi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winnsi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dnsapi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rasadhlp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: fwpuclnt.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: schannel.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mskeyprotect.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncryptsslp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: msasn1.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptsp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rsaenh.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptbase.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wsock32.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: version.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: winmm.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: mpr.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wininet.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: iphlpapi.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: userenv.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: windows.storage.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wldp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: propsys.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: urlmon.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: iertutil.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: srvcli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: netutils.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: windows.shell.servicehostbuilder.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: onecoreuapcommonproxystub.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: ieframe.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: netapi32.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wkscli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: windows.staterepositoryps.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: edputil.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: secur32.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: mlang.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: profapi.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: policymanager.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: msvcp110_win.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: onecorecommonproxystub.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: pcacli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: sfc_os.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: ieframe.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: netapi32.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wkscli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: ieframe.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: netapi32.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wkscli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: ieframe.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: netapi32.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: wkscli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: appresolver.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: bcp47langs.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: slc.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeSection loaded: sppc.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winmm.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winhttp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: wininet.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mswsock.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: devobj.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: webio.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: iphlpapi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: winnsi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: dnsapi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rasadhlp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: fwpuclnt.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: schannel.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: mskeyprotect.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ntasn1.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncrypt.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: ncryptsslp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: msasn1.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptsp.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: rsaenh.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: cryptbase.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: gpapi.dll
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: taskschd.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: sspicli.dll
                        Source: C:\Windows\SysWOW64\schtasks.exeSection loaded: xmllite.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: winmm.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: wininet.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: sspicli.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: uxtheme.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: mstask.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: windows.storage.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: wldp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: mpr.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: dui70.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: duser.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: chartv.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: onecoreuapcommonproxystub.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: oleacc.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: atlthunk.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: textinputframework.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: coreuicomponents.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: coremessaging.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: ntmarta.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: wintypes.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: wtsapi32.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: winsta.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: textshaping.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: propsys.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: explorerframe.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: windows.staterepositoryps.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: windows.fileexplorer.common.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: iertutil.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSection loaded: profapi.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: apphelp.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: acgenral.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: uxtheme.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmm.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: samcli.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: msacm32.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: version.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: userenv.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: dwmapi.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: urlmon.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: mpr.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sspicli.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: iertutil.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: srvcli.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: netutils.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: aclayers.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc_os.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: wininet.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: kernel.appcore.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: apphelp.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: acgenral.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: uxtheme.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmm.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: samcli.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: msacm32.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: version.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: userenv.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: dwmapi.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: urlmon.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: mpr.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sspicli.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: winmmbase.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: iertutil.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: srvcli.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: netutils.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: aclayers.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: sfc_os.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: wininet.dll
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: apphelp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: winmm.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: windows.storage.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: wldp.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: mscoree.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: kernel.appcore.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: version.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSection loaded: sspicli.dll
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: Section: ZLIB complexity 0.9998239966097988
                        Source: RageMP131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9998239966097988
                        Source: MPGPH131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9998239966097988
                        Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9996047247023809
                        Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9942483836206897
                        Source: plaza[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9925390625
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: Section: ZLIB complexity 0.9996047247023809
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: Section: ZLIB complexity 0.9942483836206897
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: Section: ZLIB complexity 0.9925390625
                        Source: EdgeMS131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: EdgeMS131.exe.0.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: ladas[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9998303865131579
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: Section: ZLIB complexity 0.9998303865131579
                        Source: niks[1].exe.0.drStatic PE information: Section: edffsevf ZLIB complexity 0.9944773508752575
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: Section: edffsevf ZLIB complexity 0.9944773508752575
                        Source: amert[1].exe.0.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: amert[1].exe.0.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: amert[1].exe.6.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: amert[1].exe.6.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: niks[1].exe.6.drStatic PE information: Section: edffsevf ZLIB complexity 0.9944773508752575
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: Section: edffsevf ZLIB complexity 0.9944773508752575
                        Source: plaza[1].exe.6.drStatic PE information: Section: ZLIB complexity 0.9996047247023809
                        Source: plaza[1].exe.6.drStatic PE information: Section: ZLIB complexity 0.9942483836206897
                        Source: plaza[1].exe.6.drStatic PE information: Section: ZLIB complexity 0.9925390625
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: Section: ZLIB complexity 0.9996047247023809
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: Section: ZLIB complexity 0.9942483836206897
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: Section: ZLIB complexity 0.9925390625
                        Source: ladas[1].exe.6.drStatic PE information: Section: ZLIB complexity 0.9998303865131579
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: Section: ZLIB complexity 0.9998303865131579
                        Source: niks[1].exe.7.drStatic PE information: Section: edffsevf ZLIB complexity 0.9944773508752575
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: Section: edffsevf ZLIB complexity 0.9944773508752575
                        Source: plaza[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9996047247023809
                        Source: plaza[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9942483836206897
                        Source: plaza[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9925390625
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: Section: ZLIB complexity 0.9996047247023809
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: Section: ZLIB complexity 0.9942483836206897
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: Section: ZLIB complexity 0.9925390625
                        Source: ladas[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9998303865131579
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: Section: ZLIB complexity 0.9998303865131579
                        Source: amert[1].exe.7.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: amert[1].exe.7.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: explorgu.exe.42.drStatic PE information: Section: ZLIB complexity 0.9977778495179064
                        Source: explorgu.exe.42.drStatic PE information: Section: kitsnogt ZLIB complexity 0.9945407323120189
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                        Source: RageMP131.exe.0.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                        Source: MPGPH131.exe.0.drStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
                        Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@183/701@0/92
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002AAB50 CreateToolhelp32Snapshot,6_2_002AAB50
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\RageMP131Jump to behavior
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6652:120:WilError_03
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeMutant created: NULL
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9576:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1848:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9372:120:WilError_03
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeMutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\rage131MP.tmpJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1484666355.0000000005340000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1532755673.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2765452640.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.1533495347.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2549739564.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1636124507.0000000005320000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1887520841.00000000008C1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000014.00000003.1843238183.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2088902875.00000000008C1000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1484666355.0000000005340000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1532755673.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000002.2765452640.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, MPGPH131.exe, 00000007.00000003.1533495347.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2549739564.00000000002A1000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000003.1636124507.0000000005320000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1887520841.00000000008C1000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000014.00000003.1843238183.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2088902875.00000000008C1000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1591362920.0000000006607000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1588117054.0000000006639000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1637399214.0000000005B81000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1637265731.0000000005F8C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1644578013.0000000005F7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1585474403.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1585683146.0000000005C93000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1591591456.0000000000D82000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1591412975.0000000000D7F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeReversingLabs: Detection: 47%
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeJump to behavior
                        Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                        Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                        Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
                        Source: unknownProcess created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
                        Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe"
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1936,i,5473178486326315563,2545621214023589303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1936,i,1783626661732821117,8687075592315426283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,6856639093823868645,7335846577343969463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: unknownProcess created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe "C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1916,i,11065865018849172942,2521104990630376558,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1912,i,15615417388423881991,543541311184639790,262144 /prefetch:3
                        Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1064 --field-trial-handle=2040,i,3936048782353792184,14433501436862568511,262144 /prefetch:3
                        Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                        Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2072,i,1673978244121305096,9852326822399086703,262144 /prefetch:3
                        Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
                        Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe"
                        Source: unknownProcess created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                        Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                        Source: unknownProcess created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe"
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2284 -prefMapHandle 1816 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc5eb95e-32b5-4e67-b0fb-c26c990538d2} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" 2000786cf10 socket
                        Source: unknownProcess created: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe "C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe"
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHESTJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHESTJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe" Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHESTJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHESTJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe" Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe" Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1936,i,1783626661732821117,8687075592315426283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1936,i,5473178486326315563,2545621214023589303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,6856639093823868645,7335846577343969463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1916,i,11065865018849172942,2521104990630376558,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1912,i,15615417388423881991,543541311184639790,262144 /prefetch:3
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1064 --field-trial-handle=2040,i,3936048782353792184,14433501436862568511,262144 /prefetch:3
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2072,i,1673978244121305096,9852326822399086703,262144 /prefetch:3
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2284 -prefMapHandle 1816 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc5eb95e-32b5-4e67-b0fb-c26c990538d2} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" 2000786cf10 socket
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknown
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1A66AEDC-93C3-4ACC-BA96-08F5716429F7}\InProcServer32
                        Source: EdgeMS131.lnk.0.drLNK file: ..\..\..\..\..\..\Local\Temp\EdgeMS131\EdgeMS131.exe
                        Source: Sheets.lnk.13.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                        Source: Gmail.lnk.13.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                        Source: Slides.lnk.13.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                        Source: Docs.lnk.13.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                        Source: Google Drive.lnk.13.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                        Source: YouTube.lnk.13.drLNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
                        Source: Window RecorderWindow detected: More than 3 window changes detected
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic file information: File size 2399232 > 1048576
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: Raw size of zcmtppku is bigger than: 0x100000 < 0x1b5400
                        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdbV source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: z:\task_1551543573\build\openh264\gmpopenh264.pdb source: firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmp

                        Data Obfuscation

                        barindex
                        Detected unpacking (changes PE section rights)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeUnpacked PE file: 0.2.SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe.a40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW;
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeUnpacked PE file: 6.2.MPGPH131.exe.2a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW;
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeUnpacked PE file: 7.2.MPGPH131.exe.2a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW;
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 8.2.RageMP131.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW;
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeUnpacked PE file: 20.2.RageMP131.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zcmtppku:EW;kmucpvwr:EW;.taggant:EW;
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeUnpacked PE file: 42.2.dHERKKd2xGPyY5Ssqp_N.exe.dc0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kitsnogt:EW;uwuqcgqm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kitsnogt:EW;uwuqcgqm:EW;.taggant:EW;
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeUnpacked PE file: 43.2.MSIUpdaterV131.exe.e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kitsnogt:EW;uwuqcgqm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kitsnogt:EW;uwuqcgqm:EW;.taggant:EW;
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeUnpacked PE file: 48.2.MSIUpdaterV131.exe.e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kitsnogt:EW;uwuqcgqm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kitsnogt:EW;uwuqcgqm:EW;.taggant:EW;
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeUnpacked PE file: 49.2.4sPiYiirBc4Eg8wqN443.exe.e00000.0.unpack :EW;.rsrc:W;.idata :W; :EW;edffsevf:EW;xbfgsjgd:EW; vs :ER;.rsrc:W;
                        Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: real checksum: 0x0 should be: 0x2ffec6
                        Source: ladas[1].exe.7.drStatic PE information: real checksum: 0x250c98 should be: 0x24c7fb
                        Source: amert[1].exe.0.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: amert[1].exe.6.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: well[1].exe.6.drStatic PE information: real checksum: 0x120aa8 should be: 0x50a5d
                        Source: plaza[1].exe.7.drStatic PE information: real checksum: 0x0 should be: 0x2ffec6
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: real checksum: 0x258ce5 should be: 0x24f5ae
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: real checksum: 0x250c98 should be: 0x24c7fb
                        Source: RageMP131.exe.0.drStatic PE information: real checksum: 0x258ce5 should be: 0x24f5ae
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: real checksum: 0x0 should be: 0x2ffec6
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: real checksum: 0x0 should be: 0x2ffec6
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: ladas[1].exe.6.drStatic PE information: real checksum: 0x250c98 should be: 0x24c7fb
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: real checksum: 0x250c98 should be: 0x24c7fb
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: plaza[1].exe.6.drStatic PE information: real checksum: 0x0 should be: 0x2ffec6
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: real checksum: 0x250c98 should be: 0x24c7fb
                        Source: plaza[1].exe.0.drStatic PE information: real checksum: 0x0 should be: 0x2ffec6
                        Source: EdgeMS131.exe.0.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: explorgu.exe.42.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: amert[1].exe.7.drStatic PE information: real checksum: 0x1d887e should be: 0x1e5fc5
                        Source: MPGPH131.exe.0.drStatic PE information: real checksum: 0x258ce5 should be: 0x24f5ae
                        Source: ladas[1].exe.0.drStatic PE information: real checksum: 0x250c98 should be: 0x24c7fb
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name:
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name: .idata
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name:
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name: zcmtppku
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name: kmucpvwr
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name: .taggant
                        Source: RageMP131.exe.0.drStatic PE information: section name:
                        Source: RageMP131.exe.0.drStatic PE information: section name: .idata
                        Source: RageMP131.exe.0.drStatic PE information: section name:
                        Source: RageMP131.exe.0.drStatic PE information: section name: zcmtppku
                        Source: RageMP131.exe.0.drStatic PE information: section name: kmucpvwr
                        Source: RageMP131.exe.0.drStatic PE information: section name: .taggant
                        Source: MPGPH131.exe.0.drStatic PE information: section name:
                        Source: MPGPH131.exe.0.drStatic PE information: section name: .idata
                        Source: MPGPH131.exe.0.drStatic PE information: section name:
                        Source: MPGPH131.exe.0.drStatic PE information: section name: zcmtppku
                        Source: MPGPH131.exe.0.drStatic PE information: section name: kmucpvwr
                        Source: MPGPH131.exe.0.drStatic PE information: section name: .taggant
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: plaza[1].exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name:
                        Source: EdgeMS131.exe.0.drStatic PE information: section name:
                        Source: EdgeMS131.exe.0.drStatic PE information: section name: .idata
                        Source: EdgeMS131.exe.0.drStatic PE information: section name:
                        Source: EdgeMS131.exe.0.drStatic PE information: section name: kitsnogt
                        Source: EdgeMS131.exe.0.drStatic PE information: section name: uwuqcgqm
                        Source: EdgeMS131.exe.0.drStatic PE information: section name: .taggant
                        Source: ladas[1].exe.0.drStatic PE information: section name:
                        Source: ladas[1].exe.0.drStatic PE information: section name: .idata
                        Source: ladas[1].exe.0.drStatic PE information: section name:
                        Source: ladas[1].exe.0.drStatic PE information: section name: bqhqoftp
                        Source: ladas[1].exe.0.drStatic PE information: section name: grvnhumg
                        Source: ladas[1].exe.0.drStatic PE information: section name: .taggant
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name:
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name: .idata
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name:
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name: bqhqoftp
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name: grvnhumg
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name: .taggant
                        Source: niks[1].exe.0.drStatic PE information: section name:
                        Source: niks[1].exe.0.drStatic PE information: section name: .idata
                        Source: niks[1].exe.0.drStatic PE information: section name:
                        Source: niks[1].exe.0.drStatic PE information: section name: edffsevf
                        Source: niks[1].exe.0.drStatic PE information: section name: xbfgsjgd
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name:
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name: .idata
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name:
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name: edffsevf
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name: xbfgsjgd
                        Source: amert[1].exe.0.drStatic PE information: section name:
                        Source: amert[1].exe.0.drStatic PE information: section name: .idata
                        Source: amert[1].exe.0.drStatic PE information: section name:
                        Source: amert[1].exe.0.drStatic PE information: section name: kitsnogt
                        Source: amert[1].exe.0.drStatic PE information: section name: uwuqcgqm
                        Source: amert[1].exe.0.drStatic PE information: section name: .taggant
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name:
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name: .idata
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name:
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name: kitsnogt
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name: uwuqcgqm
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name: .taggant
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: .idata
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: kitsnogt
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: uwuqcgqm
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: .taggant
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: .idata
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name:
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: kitsnogt
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: uwuqcgqm
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: .taggant
                        Source: amert[1].exe.6.drStatic PE information: section name:
                        Source: amert[1].exe.6.drStatic PE information: section name: .idata
                        Source: amert[1].exe.6.drStatic PE information: section name:
                        Source: amert[1].exe.6.drStatic PE information: section name: kitsnogt
                        Source: amert[1].exe.6.drStatic PE information: section name: uwuqcgqm
                        Source: amert[1].exe.6.drStatic PE information: section name: .taggant
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name:
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name: .idata
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name:
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name: kitsnogt
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name: uwuqcgqm
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name: .taggant
                        Source: niks[1].exe.6.drStatic PE information: section name:
                        Source: niks[1].exe.6.drStatic PE information: section name: .idata
                        Source: niks[1].exe.6.drStatic PE information: section name:
                        Source: niks[1].exe.6.drStatic PE information: section name: edffsevf
                        Source: niks[1].exe.6.drStatic PE information: section name: xbfgsjgd
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name:
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name: .idata
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name:
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name: edffsevf
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name: xbfgsjgd
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: plaza[1].exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name:
                        Source: ladas[1].exe.6.drStatic PE information: section name:
                        Source: ladas[1].exe.6.drStatic PE information: section name: .idata
                        Source: ladas[1].exe.6.drStatic PE information: section name:
                        Source: ladas[1].exe.6.drStatic PE information: section name: bqhqoftp
                        Source: ladas[1].exe.6.drStatic PE information: section name: grvnhumg
                        Source: ladas[1].exe.6.drStatic PE information: section name: .taggant
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name:
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name: .idata
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name:
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name: bqhqoftp
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name: grvnhumg
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name: .taggant
                        Source: niks[1].exe.7.drStatic PE information: section name:
                        Source: niks[1].exe.7.drStatic PE information: section name: .idata
                        Source: niks[1].exe.7.drStatic PE information: section name:
                        Source: niks[1].exe.7.drStatic PE information: section name: edffsevf
                        Source: niks[1].exe.7.drStatic PE information: section name: xbfgsjgd
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name:
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name: .idata
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name:
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name: edffsevf
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name: xbfgsjgd
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: plaza[1].exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name:
                        Source: ladas[1].exe.7.drStatic PE information: section name:
                        Source: ladas[1].exe.7.drStatic PE information: section name: .idata
                        Source: ladas[1].exe.7.drStatic PE information: section name:
                        Source: ladas[1].exe.7.drStatic PE information: section name: bqhqoftp
                        Source: ladas[1].exe.7.drStatic PE information: section name: grvnhumg
                        Source: ladas[1].exe.7.drStatic PE information: section name: .taggant
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name:
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name: .idata
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name:
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name: bqhqoftp
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name: grvnhumg
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name: .taggant
                        Source: amert[1].exe.7.drStatic PE information: section name:
                        Source: amert[1].exe.7.drStatic PE information: section name: .idata
                        Source: amert[1].exe.7.drStatic PE information: section name:
                        Source: amert[1].exe.7.drStatic PE information: section name: kitsnogt
                        Source: amert[1].exe.7.drStatic PE information: section name: uwuqcgqm
                        Source: amert[1].exe.7.drStatic PE information: section name: .taggant
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name:
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name: .idata
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name:
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name: kitsnogt
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name: uwuqcgqm
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name: .taggant
                        Source: gmpopenh264.dll.tmp.39.drStatic PE information: section name: .rodata
                        Source: explorgu.exe.42.drStatic PE information: section name:
                        Source: explorgu.exe.42.drStatic PE information: section name: .idata
                        Source: explorgu.exe.42.drStatic PE information: section name:
                        Source: explorgu.exe.42.drStatic PE information: section name: kitsnogt
                        Source: explorgu.exe.42.drStatic PE information: section name: uwuqcgqm
                        Source: explorgu.exe.42.drStatic PE information: section name: .taggant
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B1D157 push ecx; ret 0_2_00B1D16A
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0037D157 push ecx; ret 6_2_0037D16A
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name: entropy: 7.983941674526406
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeStatic PE information: section name: zcmtppku entropy: 7.91533177692051
                        Source: RageMP131.exe.0.drStatic PE information: section name: entropy: 7.983941674526406
                        Source: RageMP131.exe.0.drStatic PE information: section name: zcmtppku entropy: 7.91533177692051
                        Source: MPGPH131.exe.0.drStatic PE information: section name: entropy: 7.983941674526406
                        Source: MPGPH131.exe.0.drStatic PE information: section name: zcmtppku entropy: 7.91533177692051
                        Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.999622342475307
                        Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.9916028767402025
                        Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.316484298298194
                        Source: plaza[1].exe.0.drStatic PE information: section name: entropy: 7.981999467878961
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name: entropy: 7.999622342475307
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name: entropy: 7.9916028767402025
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name: entropy: 7.316484298298194
                        Source: 3rOLtV34Ut0fTkzynGHi.exe.0.drStatic PE information: section name: entropy: 7.981999467878961
                        Source: EdgeMS131.exe.0.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: EdgeMS131.exe.0.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: ladas[1].exe.0.drStatic PE information: section name: entropy: 7.980391693915322
                        Source: ladas[1].exe.0.drStatic PE information: section name: bqhqoftp entropy: 7.9512710718984865
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name: entropy: 7.980391693915322
                        Source: IDzOFuKIaHRpmM4TfCyF.exe.0.drStatic PE information: section name: bqhqoftp entropy: 7.9512710718984865
                        Source: niks[1].exe.0.drStatic PE information: section name: entropy: 7.794885023152522
                        Source: niks[1].exe.0.drStatic PE information: section name: edffsevf entropy: 7.95331790732843
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name: entropy: 7.794885023152522
                        Source: 4sPiYiirBc4Eg8wqN443.exe.0.drStatic PE information: section name: edffsevf entropy: 7.95331790732843
                        Source: amert[1].exe.0.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: amert[1].exe.0.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: dHERKKd2xGPyY5Ssqp_N.exe.0.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: AdobeUpdaterV131.exe.0.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: MSIUpdaterV131.exe.0.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: amert[1].exe.6.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: amert[1].exe.6.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: tkp2xLI98ZeXjg0exnoU.exe.6.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: niks[1].exe.6.drStatic PE information: section name: entropy: 7.794885023152522
                        Source: niks[1].exe.6.drStatic PE information: section name: edffsevf entropy: 7.95331790732843
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name: entropy: 7.794885023152522
                        Source: r3bD9GPTMOGYxgEqy2KG.exe.6.drStatic PE information: section name: edffsevf entropy: 7.95331790732843
                        Source: plaza[1].exe.6.drStatic PE information: section name: entropy: 7.999622342475307
                        Source: plaza[1].exe.6.drStatic PE information: section name: entropy: 7.9916028767402025
                        Source: plaza[1].exe.6.drStatic PE information: section name: entropy: 7.316484298298194
                        Source: plaza[1].exe.6.drStatic PE information: section name: entropy: 7.981999467878961
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name: entropy: 7.999622342475307
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name: entropy: 7.9916028767402025
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name: entropy: 7.316484298298194
                        Source: HhXfzERnI4EYVEjNyANc.exe.6.drStatic PE information: section name: entropy: 7.981999467878961
                        Source: ladas[1].exe.6.drStatic PE information: section name: entropy: 7.980391693915322
                        Source: ladas[1].exe.6.drStatic PE information: section name: bqhqoftp entropy: 7.9512710718984865
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name: entropy: 7.980391693915322
                        Source: BzN7a4ewVcXrTgzQjQz2.exe.6.drStatic PE information: section name: bqhqoftp entropy: 7.9512710718984865
                        Source: niks[1].exe.7.drStatic PE information: section name: entropy: 7.794885023152522
                        Source: niks[1].exe.7.drStatic PE information: section name: edffsevf entropy: 7.95331790732843
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name: entropy: 7.794885023152522
                        Source: AqC0xzKsd_7euDTV6SA_.exe.7.drStatic PE information: section name: edffsevf entropy: 7.95331790732843
                        Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.999622342475307
                        Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.9916028767402025
                        Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.316484298298194
                        Source: plaza[1].exe.7.drStatic PE information: section name: entropy: 7.981999467878961
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name: entropy: 7.999622342475307
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name: entropy: 7.9916028767402025
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name: entropy: 7.316484298298194
                        Source: 8PXzAAoEBuHCTzP4RBWU.exe.7.drStatic PE information: section name: entropy: 7.981999467878961
                        Source: ladas[1].exe.7.drStatic PE information: section name: entropy: 7.980391693915322
                        Source: ladas[1].exe.7.drStatic PE information: section name: bqhqoftp entropy: 7.9512710718984865
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name: entropy: 7.980391693915322
                        Source: zFHlx6IqQx3xR1F02yH2.exe.7.drStatic PE information: section name: bqhqoftp entropy: 7.9512710718984865
                        Source: amert[1].exe.7.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: amert[1].exe.7.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: 7roqVJbvngCJVdY0TyvA.exe.7.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: explorgu.exe.42.drStatic PE information: section name: entropy: 7.983330876714039
                        Source: explorgu.exe.42.drStatic PE information: section name: kitsnogt entropy: 7.954741541462841
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\6EzL3hHTS7jbM2Oz3y4V.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\amert[1].exeJump to dropped file
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile created: C:\Users\user\AppData\Local\Temp\00c07260dc\explorgu.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\niks[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\niks[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\AqC0xzKsd_7euDTV6SA_.exeJump to dropped file
                        Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\BzN7a4ewVcXrTgzQjQz2.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\well[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\amert[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\plaza[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\well[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\well[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HhXfzERnI4EYVEjNyANc.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\7roqVJbvngCJVdY0TyvA.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\EdgeMS131\EdgeMS131.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\WWQdc6vczGf1JWs0hh6W.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\fu[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\ladas[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\amert[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\niks[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\8PXzAAoEBuHCTzP4RBWU.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\IDzOFuKIaHRpmM4TfCyF.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\tkp2xLI98ZeXjg0exnoU.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HaJpYvk8t0RJ45fl1Ifn.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\plaza[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\plaza[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\KxZFCNaRhrDevdKhe6iU.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\r3bD9GPTMOGYxgEqy2KG.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\3rOLtV34Ut0fTkzynGHi.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ladas[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\zFHlx6IqQx3xR1F02yH2.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\fu[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\fu[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\ladas[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\ProgramData\MPGPH131\MPGPH131.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeJump to dropped file

                        Boot Survival

                        barindex
                        Creates multiple autostart registry keys
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131Jump to behavior
                        Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: FilemonClassJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: RegmonClassJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: FilemonClassJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: RegmonclassJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: FilemonclassJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeWindow searched: window name: RegmonclassJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClassJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClassJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonclassJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonclassJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonclassJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClass
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: RegmonClass
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: FilemonClass
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: Regmonclass
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: Filemonclass
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Filemonclass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: RegmonClass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Regmonclass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: Filemonclass
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: RegmonClass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: Regmonclass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: Filemonclass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: RegmonClass
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: RegmonClass
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: FilemonClass
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: RegmonClass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: FilemonClass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: Regmonclass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: Filemonclass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeWindow searched: window name: PROCMON_WINDOW_CLASS
                        Uses schtasks.exe or at.exe to add and modify task schedules
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnkJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile created: C:\Windows\Tasks\explorgu.job
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnkJump to behavior
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdateJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess information set: NOOPENFILEERRORBOX

                        Malware Analysis System Evasion

                        barindex
                        Tries to detect sandboxes / dynamic malware analysis system (registry check)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeFile opened: HKEY_CURRENT_USER\Software\Wine
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                        Tries to detect virtualization through RDTSC time measurements
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000B8DC7D second address: 0000000000B8DC83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000B8DC83 second address: 0000000000B8DC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D08917 second address: 0000000000D08931 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483126h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000CF25B3 second address: 0000000000CF25D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Ch 0x00000007 jmp 00007FCF9C692A13h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000CF25D6 second address: 0000000000CF25DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0795C second address: 0000000000D07962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D07962 second address: 0000000000D07969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D07F08 second address: 0000000000D07F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D07F0E second address: 0000000000D07F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D07F14 second address: 0000000000D07F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0807A second address: 0000000000D08084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D08084 second address: 0000000000D08092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCF9C692A0Ah 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D08092 second address: 0000000000D080A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Bh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0BD59 second address: 0000000000D0BDAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCF9C692A17h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e ja 00007FCF9C692A23h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a jp 00007FCF9C692A08h 0x00000020 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0BDAA second address: 0000000000D0BDDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCF9D48311Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jmp 00007FCF9D483120h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 pushad 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0BDDA second address: 0000000000D0BDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0BDE3 second address: 0000000000B8DC7D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [ebp+122D1EDDh], edi 0x0000000e push dword ptr [ebp+122D0365h] 0x00000014 mov esi, eax 0x00000016 call dword ptr [ebp+122D1F15h] 0x0000001c pushad 0x0000001d pushad 0x0000001e movsx edi, bx 0x00000021 xor edx, dword ptr [ebp+122D383Eh] 0x00000027 popad 0x00000028 xor eax, eax 0x0000002a ja 00007FCF9D48311Eh 0x00000030 pushad 0x00000031 mov ecx, dword ptr [ebp+122D3B6Ah] 0x00000037 popad 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c mov dword ptr [ebp+122D2709h], edx 0x00000042 mov dword ptr [ebp+122D3A62h], eax 0x00000048 jmp 00007FCF9D483125h 0x0000004d mov esi, 0000003Ch 0x00000052 pushad 0x00000053 add edi, 5FD59547h 0x00000059 mov edx, dword ptr [ebp+122D386Eh] 0x0000005f popad 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 or dword ptr [ebp+122D2709h], esi 0x0000006a lodsw 0x0000006c cmc 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 jmp 00007FCF9D483129h 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a add dword ptr [ebp+122D2709h], eax 0x00000080 nop 0x00000081 jmp 00007FCF9D483125h 0x00000086 push eax 0x00000087 push eax 0x00000088 push edx 0x00000089 jne 00007FCF9D48312Ah 0x0000008f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C0FB second address: 0000000000D0C14B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jl 00007FCF9C692A0Ch 0x00000010 or ecx, 2627D020h 0x00000016 lea ebx, dword ptr [ebp+12451CA7h] 0x0000001c mov edx, ebx 0x0000001e push ecx 0x0000001f mov edx, dword ptr [ebp+122D3986h] 0x00000025 pop esi 0x00000026 xchg eax, ebx 0x00000027 jmp 00007FCF9C692A19h 0x0000002c push eax 0x0000002d push edi 0x0000002e jc 00007FCF9C692A0Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C1C5 second address: 0000000000D0C1D2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCF9D483116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C1D2 second address: 0000000000D0C1E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCF9C692A06h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C1E6 second address: 0000000000D0C1EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C1EB second address: 0000000000D0C1F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C1F1 second address: 0000000000D0C231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edx 0x00000010 push ebx 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop ebx 0x00000014 pop edx 0x00000015 mov eax, dword ptr [eax] 0x00000017 jmp 00007FCF9D483126h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C231 second address: 0000000000D0C235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C235 second address: 0000000000D0C244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FCF9D483116h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C244 second address: 0000000000D0C27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 mov edx, dword ptr [ebp+122D386Eh] 0x0000000d push 00000003h 0x0000000f push edi 0x00000010 push esi 0x00000011 add edx, dword ptr [ebp+122D385Ah] 0x00000017 pop edi 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b mov edx, dword ptr [ebp+122D1CC6h] 0x00000021 push 00000003h 0x00000023 mov dx, 8884h 0x00000027 call 00007FCF9C692A09h 0x0000002c push eax 0x0000002d push edx 0x0000002e push edi 0x0000002f pushad 0x00000030 popad 0x00000031 pop edi 0x00000032 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C27A second address: 0000000000D0C2B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCF9D48311Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e js 00007FCF9D48311Eh 0x00000014 jng 00007FCF9D483118h 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 jnc 00007FCF9D483116h 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C2B0 second address: 0000000000D0C2B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C2B6 second address: 0000000000D0C2F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483123h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e jmp 00007FCF9D483128h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jo 00007FCF9D48311Eh 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C2F8 second address: 0000000000D0C34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push 00000000h 0x00000008 push ebp 0x00000009 call 00007FCF9C692A08h 0x0000000e pop ebp 0x0000000f mov dword ptr [esp+04h], ebp 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc ebp 0x0000001c push ebp 0x0000001d ret 0x0000001e pop ebp 0x0000001f ret 0x00000020 mov ecx, 55C5AAD1h 0x00000025 lea ebx, dword ptr [ebp+12451CB2h] 0x0000002b mov ecx, 22E4B992h 0x00000030 mov edi, ebx 0x00000032 xchg eax, ebx 0x00000033 jl 00007FCF9C692A0Ah 0x00000039 push edi 0x0000003a pushad 0x0000003b popad 0x0000003c pop edi 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jg 00007FCF9C692A0Ch 0x00000046 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C34B second address: 0000000000D0C351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D0C351 second address: 0000000000D0C355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2B5F0 second address: 0000000000D2B5F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2B8AF second address: 0000000000D2B8CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007FCF9C692A18h 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2B8CE second address: 0000000000D2B8EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483128h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2B8EE second address: 0000000000D2B8F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2BA79 second address: 0000000000D2BA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d js 00007FCF9D483116h 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2BD3D second address: 0000000000D2BD5C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FCF9C692A11h 0x00000012 pop ecx 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2BD5C second address: 0000000000D2BD62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2BD62 second address: 0000000000D2BD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2BD66 second address: 0000000000D2BD6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2BD6A second address: 0000000000D2BD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2BD70 second address: 0000000000D2BD7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2C048 second address: 0000000000D2C04E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2C436 second address: 0000000000D2C453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FCF9D483126h 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D2C453 second address: 0000000000D2C467 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FCF9C692A0Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31A47 second address: 0000000000D31A4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31A4B second address: 0000000000D31A51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31A51 second address: 0000000000D31A77 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCF9D483127h 0x00000008 jmp 00007FCF9D483121h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jl 00007FCF9D483116h 0x0000001a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31A77 second address: 0000000000D31A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31A7B second address: 0000000000D31A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31A81 second address: 0000000000D31A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31F2C second address: 0000000000D31F41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FCF9D483120h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D31F41 second address: 0000000000D31F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCF9C692A0Bh 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D320ED second address: 0000000000D320F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D320F3 second address: 0000000000D32101 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D32101 second address: 0000000000D32116 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jc 00007FCF9D483120h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D32116 second address: 0000000000D32127 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push edi 0x00000009 jc 00007FCF9C692A0Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D32127 second address: 0000000000D32134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D32134 second address: 0000000000D3213A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D32211 second address: 0000000000D3222C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FCF9D483116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d jng 00007FCF9D483128h 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007FCF9D483116h 0x0000001b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D34180 second address: 0000000000D34186 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D34186 second address: 0000000000D34190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D34190 second address: 0000000000D34196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000CFC711 second address: 0000000000CFC716 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000CFC716 second address: 0000000000CFC729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 js 00007FCF9C692A12h 0x0000000b jno 00007FCF9C692A06h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000CFC729 second address: 0000000000CFC73B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FCF9D483116h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000CFC73B second address: 0000000000CFC741 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D36CBE second address: 0000000000D36CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B098 second address: 0000000000D3B09E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B09E second address: 0000000000D3B0A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B0A7 second address: 0000000000D3B0AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B0AD second address: 0000000000D3B0B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FCF9D483116h 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B353 second address: 0000000000D3B364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jc 00007FCF9C692A12h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B364 second address: 0000000000D3B36A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B36A second address: 0000000000D3B372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B372 second address: 0000000000D3B37B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B50A second address: 0000000000D3B536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnl 00007FCF9C692A06h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FCF9C692A12h 0x00000013 popad 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007FCF9C692A06h 0x0000001f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3B536 second address: 0000000000D3B546 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FCF9D483116h 0x00000008 jg 00007FCF9D483116h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3BACC second address: 0000000000D3BAD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3BAD4 second address: 0000000000D3BADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3C3F1 second address: 0000000000D3C407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9C692A12h 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3C407 second address: 0000000000D3C40B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3C48C second address: 0000000000D3C49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 jc 00007FCF9C692A10h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3C49F second address: 0000000000D3C4BE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jc 00007FCF9D48311Eh 0x00000010 jns 00007FCF9D483118h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3C874 second address: 0000000000D3C878 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D046 second address: 0000000000D3D04C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D0B6 second address: 0000000000D3D0DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jmp 00007FCF9C692A0Bh 0x0000000f pop edi 0x00000010 pop eax 0x00000011 xchg eax, ebx 0x00000012 mov di, cx 0x00000015 push eax 0x00000016 jbe 00007FCF9C692A18h 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D33C second address: 0000000000D3D341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D341 second address: 0000000000D3D347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D347 second address: 0000000000D3D34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D435 second address: 0000000000D3D43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D43A second address: 0000000000D3D43F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D6E1 second address: 0000000000D3D6E7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3D6E7 second address: 0000000000D3D73C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop eax 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FCF9D483118h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov esi, dword ptr [ebp+122D3982h] 0x00000031 xchg eax, ebx 0x00000032 pushad 0x00000033 push edx 0x00000034 jg 00007FCF9D483116h 0x0000003a pop edx 0x0000003b jmp 00007FCF9D48311Ah 0x00000040 popad 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push eax 0x00000045 pop eax 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3E5DB second address: 0000000000D3E653 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FCF9C692A08h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov di, 7836h 0x00000029 push ecx 0x0000002a adc esi, 4CB81EC4h 0x00000030 pop edi 0x00000031 push 00000000h 0x00000033 mov esi, ebx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push esi 0x0000003a call 00007FCF9C692A08h 0x0000003f pop esi 0x00000040 mov dword ptr [esp+04h], esi 0x00000044 add dword ptr [esp+04h], 00000017h 0x0000004c inc esi 0x0000004d push esi 0x0000004e ret 0x0000004f pop esi 0x00000050 ret 0x00000051 cmc 0x00000052 xchg eax, ebx 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 jno 00007FCF9C692A06h 0x0000005c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3F61B second address: 0000000000D3F61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4011D second address: 0000000000D40121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D3FEA9 second address: 0000000000D3FEAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D40121 second address: 0000000000D40130 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D40130 second address: 0000000000D40136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D42D5E second address: 0000000000D42D62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D42D62 second address: 0000000000D42DA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D2352h], ebx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 xchg eax, ebx 0x00000015 pushad 0x00000016 pushad 0x00000017 jmp 00007FCF9D483123h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FCF9D483128h 0x00000026 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D43897 second address: 0000000000D4389B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D44297 second address: 0000000000D442A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007FCF9D483116h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D442A6 second address: 0000000000D4432E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FCF9C692A0Eh 0x0000000c nop 0x0000000d push edx 0x0000000e and edi, 3E687F9Ch 0x00000014 pop esi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push eax 0x0000001a call 00007FCF9C692A08h 0x0000001f pop eax 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc eax 0x0000002d push eax 0x0000002e ret 0x0000002f pop eax 0x00000030 ret 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edx 0x00000036 call 00007FCF9C692A08h 0x0000003b pop edx 0x0000003c mov dword ptr [esp+04h], edx 0x00000040 add dword ptr [esp+04h], 0000001Ch 0x00000048 inc edx 0x00000049 push edx 0x0000004a ret 0x0000004b pop edx 0x0000004c ret 0x0000004d cld 0x0000004e jno 00007FCF9C692A15h 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push ecx 0x0000005a pop ecx 0x0000005b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4432E second address: 0000000000D44332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D44332 second address: 0000000000D44338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D44338 second address: 0000000000D4433D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4433D second address: 0000000000D44343 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D47569 second address: 0000000000D4756F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D47B37 second address: 0000000000D47B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D44066 second address: 0000000000D4406A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D48C08 second address: 0000000000D48C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FCF9C692A08h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 xor dword ptr [ebp+122D1E3Ah], esi 0x0000002b push 00000000h 0x0000002d xor ebx, dword ptr [ebp+1247517Ah] 0x00000033 push 00000000h 0x00000035 add dword ptr [ebp+1244D3CEh], ebx 0x0000003b push eax 0x0000003c pushad 0x0000003d jl 00007FCF9C692A08h 0x00000043 pushad 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D48C5B second address: 0000000000D48C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D44B81 second address: 0000000000D44B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4C96C second address: 0000000000D4C985 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCF9D483116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCF9D48311Bh 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4C985 second address: 0000000000D4C9CD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCF9C692A08h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub ebx, 739D609Bh 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007FCF9C692A08h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f sub edi, 00119B68h 0x00000035 push 00000000h 0x00000037 add dword ptr [ebp+122D2137h], esi 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4C9CD second address: 0000000000D4C9D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4C9D4 second address: 0000000000D4C9FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A18h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FCF9C692A06h 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4C9FB second address: 0000000000D4CA05 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCF9D483116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4CA05 second address: 0000000000D4CA0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4D92F second address: 0000000000D4D933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D49DAB second address: 0000000000D49E40 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCF9C692A08h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FCF9C692A08h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 push 00000000h 0x00000032 push eax 0x00000033 call 00007FCF9C692A08h 0x00000038 pop eax 0x00000039 mov dword ptr [esp+04h], eax 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc eax 0x00000046 push eax 0x00000047 ret 0x00000048 pop eax 0x00000049 ret 0x0000004a mov edi, 3ABBEC74h 0x0000004f mov dword ptr fs:[00000000h], esp 0x00000056 mov ebx, 3702CB0Ch 0x0000005b mov eax, dword ptr [ebp+122D147Dh] 0x00000061 jmp 00007FCF9C692A10h 0x00000066 pushad 0x00000067 cmc 0x00000068 mov edi, dword ptr [ebp+122D3972h] 0x0000006e popad 0x0000006f push FFFFFFFFh 0x00000071 jnc 00007FCF9C692A08h 0x00000077 mov ebx, edx 0x00000079 push eax 0x0000007a pushad 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D49E40 second address: 0000000000D49E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4E9BF second address: 0000000000D4EA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FCF9C692A08h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007FCF9C692A08h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push ecx 0x00000046 call 00007FCF9C692A08h 0x0000004b pop ecx 0x0000004c mov dword ptr [esp+04h], ecx 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc ecx 0x00000059 push ecx 0x0000005a ret 0x0000005b pop ecx 0x0000005c ret 0x0000005d mov edi, 504E293Ah 0x00000062 xchg eax, esi 0x00000063 push edx 0x00000064 push eax 0x00000065 push edx 0x00000066 jnl 00007FCF9C692A06h 0x0000006c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4DB17 second address: 0000000000D4DB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 add di, 6A43h 0x0000000e jmp 00007FCF9D483126h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a add edi, dword ptr [ebp+122D3876h] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 mov di, 2DDCh 0x0000002b mov eax, dword ptr [ebp+122D0391h] 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007FCF9D483118h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b mov ebx, dword ptr [ebp+1247515Ah] 0x00000051 push FFFFFFFFh 0x00000053 or di, D29Eh 0x00000058 nop 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4DB8C second address: 0000000000D4DB90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4DB90 second address: 0000000000D4DB96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D508DB second address: 0000000000D508E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D508E2 second address: 0000000000D5093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FCF9D483118h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ah 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov ebx, dword ptr [ebp+122D38FEh] 0x00000028 mov di, 486Ah 0x0000002c push 00000000h 0x0000002e xor edi, 5ACB125Ah 0x00000034 push 00000000h 0x00000036 jmp 00007FCF9D483129h 0x0000003b xchg eax, esi 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D5093F second address: 0000000000D50944 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D50944 second address: 0000000000D50949 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D50949 second address: 0000000000D5095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 je 00007FCF9C692A0Eh 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D51933 second address: 0000000000D51939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D51939 second address: 0000000000D519C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jg 00007FCF9C692A08h 0x00000013 jmp 00007FCF9C692A0Ch 0x00000018 popad 0x00000019 nop 0x0000001a mov ebx, dword ptr [ebp+124752BBh] 0x00000020 mov di, si 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 mov dword ptr [ebp+122D28E7h], esi 0x0000002c pop edi 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007FCF9C692A08h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 0000001Dh 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 mov edi, 78A789A1h 0x0000004e xor ebx, 06475B0Fh 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push ebx 0x00000058 jmp 00007FCF9C692A17h 0x0000005d pop ebx 0x0000005e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D5297A second address: 0000000000D52980 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D52980 second address: 0000000000D529DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007FCF9C692A0Fh 0x00000011 pop ebx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007FCF9C692A08h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e movzx edi, bx 0x00000031 push 00000000h 0x00000033 add bx, F4FDh 0x00000038 push eax 0x00000039 js 00007FCF9C692A14h 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D529DA second address: 0000000000D529DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4FB81 second address: 0000000000D4FB86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54A0F second address: 0000000000D54A2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54A2C second address: 0000000000D54A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54A32 second address: 0000000000D54AD8 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCF9D483116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FCF9D483118h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D3926h] 0x0000002f mov ebx, dword ptr [ebp+122D3A42h] 0x00000035 push 00000000h 0x00000037 call 00007FCF9D483125h 0x0000003c mov bx, 4852h 0x00000040 pop ebx 0x00000041 mov bx, cx 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edi 0x00000049 call 00007FCF9D483118h 0x0000004e pop edi 0x0000004f mov dword ptr [esp+04h], edi 0x00000053 add dword ptr [esp+04h], 0000001Ch 0x0000005b inc edi 0x0000005c push edi 0x0000005d ret 0x0000005e pop edi 0x0000005f ret 0x00000060 mov edi, dword ptr [ebp+122D3906h] 0x00000066 jmp 00007FCF9D48311Eh 0x0000006b xchg eax, esi 0x0000006c pushad 0x0000006d push edx 0x0000006e jl 00007FCF9D483116h 0x00000074 pop edx 0x00000075 push edi 0x00000076 push eax 0x00000077 push edx 0x00000078 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54AD8 second address: 0000000000D54AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54AE5 second address: 0000000000D54AFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54AFA second address: 0000000000D54B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54B00 second address: 0000000000D54B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D55ACC second address: 0000000000D55AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D55AD0 second address: 0000000000D55AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D54D86 second address: 0000000000D54D8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D58E3B second address: 0000000000D58E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D58E40 second address: 0000000000D58E46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D58E46 second address: 0000000000D58E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D58E4A second address: 0000000000D58E73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jg 00007FCF9C692A06h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D5BC9F second address: 0000000000D5BD07 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCF9D483118h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FCF9D483124h 0x00000010 pushad 0x00000011 jmp 00007FCF9D483126h 0x00000016 jmp 00007FCF9D483123h 0x0000001b jg 00007FCF9D483116h 0x00000021 popad 0x00000022 pushad 0x00000023 jmp 00007FCF9D483123h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D61C12 second address: 0000000000D61C1C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D61C1C second address: 0000000000D61C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FCF9D483125h 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D61C37 second address: 0000000000D61C3D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D614A3 second address: 0000000000D614A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D614A9 second address: 0000000000D614B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FCF9C692A0Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D614B8 second address: 0000000000D614DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 jmp 00007FCF9D48311Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FCF9D483120h 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D61621 second address: 0000000000D6162B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D617B3 second address: 0000000000D617C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007FCF9D483116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D669D8 second address: 0000000000D669DE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E352 second address: 0000000000D6E36E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FCF9D483125h 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E36E second address: 0000000000D6E373 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6D157 second address: 0000000000D6D181 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483120h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007FCF9D483122h 0x00000012 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6D181 second address: 0000000000D6D18E instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6D9CE second address: 0000000000D6D9D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6DC3F second address: 0000000000D6DC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6DC43 second address: 0000000000D6DC80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Fh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push edx 0x0000000d jmp 00007FCF9D48311Ch 0x00000012 pushad 0x00000013 jmp 00007FCF9D483127h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E1C8 second address: 0000000000D6E1D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jl 00007FCF9C692A06h 0x0000000c popad 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E1D5 second address: 0000000000D6E1DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E1DA second address: 0000000000D6E1F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c jmp 00007FCF9C692A0Eh 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E1F9 second address: 0000000000D6E1FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E1FF second address: 0000000000D6E205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D6E205 second address: 0000000000D6E209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D74236 second address: 0000000000D74253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push esi 0x0000000a jmp 00007FCF9C692A12h 0x0000000f pop esi 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D74253 second address: 0000000000D74258 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D72B42 second address: 0000000000D72B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D72CD7 second address: 0000000000D72CE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FCF9D483116h 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D72F7D second address: 0000000000D72F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FCF9C692A06h 0x0000000a pop ebx 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D73404 second address: 0000000000D73408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D73408 second address: 0000000000D7340C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7340C second address: 0000000000D73412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D73412 second address: 0000000000D73422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007FCF9C692A06h 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D738B5 second address: 0000000000D738BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D738BA second address: 0000000000D738F0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FCF9C692A0Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCF9C692A13h 0x00000011 jmp 00007FCF9C692A0Fh 0x00000016 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D79092 second address: 0000000000D7909C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FCF9D48311Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4542F second address: 0000000000D45434 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45434 second address: 0000000000D45479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007FCF9D48311Eh 0x0000000f mov di, BA15h 0x00000013 lea eax, dword ptr [ebp+1248B1B6h] 0x00000019 pushad 0x0000001a jmp 00007FCF9D483122h 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jno 00007FCF9D48311Ch 0x00000029 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4597A second address: 0000000000B8DC7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a nop 0x0000000b jmp 00007FCF9C692A11h 0x00000010 push dword ptr [ebp+122D0365h] 0x00000016 cmc 0x00000017 call dword ptr [ebp+122D1F15h] 0x0000001d pushad 0x0000001e pushad 0x0000001f movsx edi, bx 0x00000022 xor edx, dword ptr [ebp+122D383Eh] 0x00000028 popad 0x00000029 xor eax, eax 0x0000002b ja 00007FCF9C692A0Eh 0x00000031 pushad 0x00000032 mov ecx, dword ptr [ebp+122D3B6Ah] 0x00000038 popad 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d mov dword ptr [ebp+122D2709h], edx 0x00000043 mov dword ptr [ebp+122D3A62h], eax 0x00000049 jmp 00007FCF9C692A15h 0x0000004e mov esi, 0000003Ch 0x00000053 pushad 0x00000054 add edi, 5FD59547h 0x0000005a mov edx, dword ptr [ebp+122D386Eh] 0x00000060 popad 0x00000061 add esi, dword ptr [esp+24h] 0x00000065 or dword ptr [ebp+122D2709h], esi 0x0000006b lodsw 0x0000006d cmc 0x0000006e add eax, dword ptr [esp+24h] 0x00000072 jmp 00007FCF9C692A19h 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b add dword ptr [ebp+122D2709h], eax 0x00000081 nop 0x00000082 jmp 00007FCF9C692A15h 0x00000087 push eax 0x00000088 push eax 0x00000089 push edx 0x0000008a jne 00007FCF9C692A1Ah 0x00000090 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45B31 second address: 0000000000D45B6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483127h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 0639056Dh 0x00000010 jmp 00007FCF9D483121h 0x00000015 push 1FD7C8C0h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45B6E second address: 0000000000D45B72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45C6E second address: 0000000000D45C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45C72 second address: 0000000000D45C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45C78 second address: 0000000000D45C7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45C7F second address: 0000000000D45CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], esi 0x0000000a mov edi, dword ptr [ebp+122D3B4Eh] 0x00000010 add di, E048h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FCF9C692A14h 0x0000001d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45DB7 second address: 0000000000D45DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45DBB second address: 0000000000D45E03 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b ja 00007FCF9C692A1Dh 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jl 00007FCF9C692A08h 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 push esi 0x00000022 pop esi 0x00000023 popad 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a jc 00007FCF9C692A06h 0x00000030 pop eax 0x00000031 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45E03 second address: 0000000000D45E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D45E09 second address: 0000000000D45E0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D46016 second address: 0000000000D4601C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D463D3 second address: 0000000000D463D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D46741 second address: 0000000000D467AF instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCF9D483116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edi 0x00000014 nop 0x00000015 push esi 0x00000016 mov cx, A3C7h 0x0000001a pop ecx 0x0000001b lea eax, dword ptr [ebp+1248B1FAh] 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007FCF9D483118h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b ja 00007FCF9D48312Dh 0x00000041 mov dx, F962h 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jnp 00007FCF9D483118h 0x0000004e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D467AF second address: 0000000000D4681C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FCF9C692A08h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 call 00007FCF9C692A0Fh 0x0000002b xor dword ptr [ebp+12479004h], edx 0x00000031 pop edi 0x00000032 lea eax, dword ptr [ebp+1248B1B6h] 0x00000038 or dword ptr [ebp+1247517Ah], edi 0x0000003e push eax 0x0000003f pushad 0x00000040 jmp 00007FCF9C692A15h 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D4681C second address: 0000000000D46822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D46822 second address: 0000000000D1FC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FCF9C692A08h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 call dword ptr [ebp+1244D424h] 0x00000029 pushad 0x0000002a jng 00007FCF9C692A1Bh 0x00000030 push esi 0x00000031 pop esi 0x00000032 jmp 00007FCF9C692A13h 0x00000037 push esi 0x00000038 jnc 00007FCF9C692A06h 0x0000003e push esi 0x0000003f pop esi 0x00000040 pop esi 0x00000041 push ebx 0x00000042 jmp 00007FCF9C692A0Bh 0x00000047 jmp 00007FCF9C692A14h 0x0000004c pop ebx 0x0000004d popad 0x0000004e push ecx 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 popad 0x00000053 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7830B second address: 0000000000D78311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78311 second address: 0000000000D78316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78316 second address: 0000000000D7831C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7831C second address: 0000000000D78320 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78320 second address: 0000000000D7832A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCF9D483116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78602 second address: 0000000000D7860A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7860A second address: 0000000000D7861A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FCF9D483116h 0x0000000a jg 00007FCF9D483116h 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78930 second address: 0000000000D78948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FCF9C692A06h 0x0000000a jns 00007FCF9C692A0Eh 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78948 second address: 0000000000D7894D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78AD6 second address: 0000000000D78AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9C692A13h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D78AEF second address: 0000000000D78AFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7D866 second address: 0000000000D7D881 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7D881 second address: 0000000000D7D8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCF9D483124h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FCF9D483116h 0x00000012 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7E2A9 second address: 0000000000D7E2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FCF9C692A0Eh 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCF9C692A16h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7E2D8 second address: 0000000000D7E313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 ja 00007FCF9D483149h 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FCF9D483129h 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d push edx 0x0000001e pop edx 0x0000001f js 00007FCF9D483116h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7E447 second address: 0000000000D7E459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D7E891 second address: 0000000000D7E895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D8683A second address: 0000000000D8684B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FCF9C692A06h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D89A33 second address: 0000000000D89A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D89A37 second address: 0000000000D89A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FCF9C692A06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FCF9C692A08h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D89A4F second address: 0000000000D89A5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FCF9D483116h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D89A5F second address: 0000000000D89A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D8929B second address: 0000000000D892A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D892A2 second address: 0000000000D892C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCF9C692A16h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FCF9C692A06h 0x00000015 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D8941E second address: 0000000000D89432 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCF9D483116h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FCF9D483116h 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D89598 second address: 0000000000D895A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FCF9C692A06h 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D895A2 second address: 0000000000D895A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D895A8 second address: 0000000000D895C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A18h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D935E9 second address: 0000000000D935F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D935F0 second address: 0000000000D935FA instructions: 0x00000000 rdtsc 0x00000002 jp 00007FCF9C692A0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D935FA second address: 0000000000D93601 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D93601 second address: 0000000000D9362B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FCF9C692A0Ah 0x0000000f pushad 0x00000010 jmp 00007FCF9C692A13h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D92054 second address: 0000000000D9206C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Fh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D461A9 second address: 0000000000D461AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D461AF second address: 0000000000D46245 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483125h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FCF9D483125h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FCF9D483118h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+1248B1F5h] 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FCF9D483118h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c mov dword ptr [ebp+122D1F9Bh], ecx 0x00000052 add eax, ebx 0x00000054 mov ecx, dword ptr [ebp+122D2A0Ch] 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FCF9D48311Dh 0x00000062 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9336D second address: 0000000000D93371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9600B second address: 0000000000D9600F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9600F second address: 0000000000D96015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D96015 second address: 0000000000D96034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FCF9D483129h 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D96466 second address: 0000000000D9646A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A812 second address: 0000000000D9A826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCF9D48311Fh 0x00000009 pop ebx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A826 second address: 0000000000D9A82C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A82C second address: 0000000000D9A836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCF9D483116h 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A836 second address: 0000000000D9A851 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCF9C692A0Fh 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A851 second address: 0000000000D9A856 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A10F second address: 0000000000D9A140 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FCF9C692A06h 0x00000009 jmp 00007FCF9C692A11h 0x0000000e jmp 00007FCF9C692A12h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A140 second address: 0000000000D9A15A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCF9D483116h 0x00000008 jbe 00007FCF9D483116h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A27B second address: 0000000000D9A27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A27F second address: 0000000000D9A2A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FCF9D483118h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCF9D483125h 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A403 second address: 0000000000D9A415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9C692A0Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000D9A415 second address: 0000000000D9A419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA2348 second address: 0000000000DA234C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA0348 second address: 0000000000DA034C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA034C second address: 0000000000DA0360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007FCF9C692A06h 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA0360 second address: 0000000000DA036E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA0642 second address: 0000000000DA0682 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCF9C692A06h 0x00000008 jmp 00007FCF9C692A18h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007FCF9C692A16h 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA0989 second address: 0000000000DA0997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA0997 second address: 0000000000DA099D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA099D second address: 0000000000DA09AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FCF9D483116h 0x0000000c popad 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA09AA second address: 0000000000DA09C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007FCF9C692A11h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA11C8 second address: 0000000000DA11D2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FCF9D483116h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA11D2 second address: 0000000000DA11D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA1A0F second address: 0000000000DA1A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA1A14 second address: 0000000000DA1A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA1A22 second address: 0000000000DA1A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA1A28 second address: 0000000000DA1A71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FCF9C692A19h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 jp 00007FCF9C692A06h 0x00000018 je 00007FCF9C692A06h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 pushad 0x00000022 jmp 00007FCF9C692A0Bh 0x00000027 jc 00007FCF9C692A06h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA1D42 second address: 0000000000DA1D48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA1D48 second address: 0000000000DA1D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA1D4C second address: 0000000000DA1D66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jnl 00007FCF9D48311Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA2018 second address: 0000000000DA2042 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A15h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FCF9C692A11h 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA2042 second address: 0000000000DA2059 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483123h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA2059 second address: 0000000000DA206B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push ebx 0x0000000a jnc 00007FCF9C692A06h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA9138 second address: 0000000000DA9150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FCF9D483116h 0x00000009 jmp 00007FCF9D48311Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA9150 second address: 0000000000DA915B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DA915B second address: 0000000000DA9169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jo 00007FCF9D483116h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DAD21E second address: 0000000000DAD23D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A16h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DAD23D second address: 0000000000DAD243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DAC668 second address: 0000000000DAC66E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DAC91B second address: 0000000000DAC928 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FCF9D483116h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DACAAE second address: 0000000000DACACD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A19h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DACD8A second address: 0000000000DACD91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DACD91 second address: 0000000000DACD97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB43C1 second address: 0000000000DB43C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB43C7 second address: 0000000000DB43D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jp 00007FCF9C692A06h 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB43D6 second address: 0000000000DB43E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB46CC second address: 0000000000DB46DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4819 second address: 0000000000DB4846 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9D483121h 0x00000009 jmp 00007FCF9D483128h 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4846 second address: 0000000000DB4865 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FCF9C692A0Dh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4A0C second address: 0000000000DB4A12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4BA9 second address: 0000000000DB4BC2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FCF9C692A0Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4BC2 second address: 0000000000DB4BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FCF9D48311Ch 0x0000000a push eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4D2A second address: 0000000000DB4D2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4D2E second address: 0000000000DB4D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4D34 second address: 0000000000DB4D60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007FCF9C692A06h 0x00000009 pop eax 0x0000000a jmp 00007FCF9C692A17h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4D60 second address: 0000000000DB4D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4D66 second address: 0000000000DB4D73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 je 00007FCF9C692A06h 0x0000000c popad 0x0000000d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4D73 second address: 0000000000DB4D8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483125h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4E92 second address: 0000000000DB4E9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4E9A second address: 0000000000DB4EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4EA1 second address: 0000000000DB4EB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jl 00007FCF9C692A06h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4EB4 second address: 0000000000DB4EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4EB8 second address: 0000000000DB4EE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A15h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c js 00007FCF9C692A06h 0x00000012 jo 00007FCF9C692A06h 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB4EE5 second address: 0000000000DB4EE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB5026 second address: 0000000000DB5041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FCF9C692A16h 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB5842 second address: 0000000000DB5848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB5F82 second address: 0000000000DB5F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB5F88 second address: 0000000000DB5F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB3CED second address: 0000000000DB3D0C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FCF9C692A19h 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB3D0C second address: 0000000000DB3D11 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DB3D11 second address: 0000000000DB3D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jne 00007FCF9C692A06h 0x0000000e je 00007FCF9C692A06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DBDF38 second address: 0000000000DBDF5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FCF9D483129h 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DBDF5B second address: 0000000000DBDF76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FCF9C692A10h 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DBE122 second address: 0000000000DBE132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jbe 00007FCF9D483116h 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DBE132 second address: 0000000000DBE178 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007FCF9C692A0Bh 0x00000010 pushad 0x00000011 jmp 00007FCF9C692A15h 0x00000016 jg 00007FCF9C692A06h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DBE2D4 second address: 0000000000DBE2FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push edx 0x0000000b jmp 00007FCF9D483127h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCC4A1 second address: 0000000000DCC4AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCC4AD second address: 0000000000DCC4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jns 00007FCF9D48311Eh 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCC4C0 second address: 0000000000DCC4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCC4C6 second address: 0000000000DCC4CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCEAC5 second address: 0000000000DCEACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCEACB second address: 0000000000DCEAE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FCF9D483125h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE5ED second address: 0000000000DCE5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE5F1 second address: 0000000000DCE5F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE5F7 second address: 0000000000DCE605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE605 second address: 0000000000DCE609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE609 second address: 0000000000DCE60D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE78C second address: 0000000000DCE796 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FCF9D483116h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE796 second address: 0000000000DCE79C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DCE79C second address: 0000000000DCE7AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DD5265 second address: 0000000000DD526B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DD526B second address: 0000000000DD5270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DDCE07 second address: 0000000000DDCE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DDCE0B second address: 0000000000DDCE1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FCF9D483116h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DDCCA2 second address: 0000000000DDCCA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DDCCA8 second address: 0000000000DDCCAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE56CA second address: 0000000000DE56CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE56CE second address: 0000000000DE56D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE5835 second address: 0000000000DE5868 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A10h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FCF9C692A12h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007FCF9C692A08h 0x00000019 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE5868 second address: 0000000000DE5874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jg 00007FCF9D483116h 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE5B53 second address: 0000000000DE5B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE613D second address: 0000000000DE6143 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE6143 second address: 0000000000DE6149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE6149 second address: 0000000000DE616E instructions: 0x00000000 rdtsc 0x00000002 js 00007FCF9D48311Eh 0x00000008 jg 00007FCF9D483116h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FCF9D48311Eh 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DE616E second address: 0000000000DE6190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FCF9C692A19h 0x0000000d popad 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000DEA56A second address: 0000000000DEA575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E01606 second address: 0000000000E0160A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E0160A second address: 0000000000E0160E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E0E60A second address: 0000000000E0E619 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E0E619 second address: 0000000000E0E640 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FCF9D48311Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e jmp 00007FCF9D48311Ah 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E0E496 second address: 0000000000E0E4A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FCF9C692A06h 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E0E4A0 second address: 0000000000E0E4BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FCF9D483126h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E10EF0 second address: 0000000000E10EF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E10EF4 second address: 0000000000E10F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FCF9D48311Eh 0x0000000c rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E10F08 second address: 0000000000E10F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E392A1 second address: 0000000000E392A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E392A5 second address: 0000000000E392AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E395CF second address: 0000000000E395E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jno 00007FCF9D483116h 0x0000000c jne 00007FCF9D483116h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E395E3 second address: 0000000000E395E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E395E9 second address: 0000000000E395EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E395EE second address: 0000000000E395F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FCF9C692A06h 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E395F8 second address: 0000000000E39613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FCF9D483121h 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E39613 second address: 0000000000E39623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FCF9C692A06h 0x0000000a jc 00007FCF9C692A06h 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E39623 second address: 0000000000E39629 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E39A6A second address: 0000000000E39A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E39F16 second address: 0000000000E39F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E39F1A second address: 0000000000E39F24 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FCF9C692A06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E39F24 second address: 0000000000E39F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FCF9D483118h 0x0000000e rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3BB47 second address: 0000000000E3BB5D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FCF9C692A06h 0x00000008 jmp 00007FCF9C692A0Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3BB5D second address: 0000000000E3BB62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3BB62 second address: 0000000000E3BB93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FCF9C692A0Ch 0x00000009 jg 00007FCF9C692A06h 0x0000000f ja 00007FCF9C692A06h 0x00000015 popad 0x00000016 jmp 00007FCF9C692A0Dh 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3BB93 second address: 0000000000E3BB99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3BB99 second address: 0000000000E3BB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3BB9E second address: 0000000000E3BBB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FCF9D48311Bh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FCF9D483116h 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3D2F7 second address: 0000000000E3D2FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E3FE05 second address: 0000000000E3FE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E40425 second address: 0000000000E40471 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dh, cl 0x0000000d add edx, dword ptr [ebp+122D381Ah] 0x00000013 push dword ptr [ebp+122D311Dh] 0x00000019 mov edx, dword ptr [ebp+12478FF3h] 0x0000001f call 00007FCF9C692A09h 0x00000024 je 00007FCF9C692A12h 0x0000002a jnc 00007FCF9C692A0Ch 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FCF9C692A0Fh 0x00000038 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E40471 second address: 0000000000E4049B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FCF9D48311Dh 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E41AC0 second address: 0000000000E41AC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E43B1D second address: 0000000000E43B27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FCF9D483116h 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E43B27 second address: 0000000000E43B31 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FCF9C692A06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E43B31 second address: 0000000000E43B3B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000000E43B3B second address: 0000000000E43B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000553085B second address: 0000000005530878 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005530878 second address: 000000000553089D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCF9C692A0Dh 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000553089D second address: 00000000055308A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055308A3 second address: 00000000055308A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055308A7 second address: 00000000055308AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055705B3 second address: 00000000055705C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055705C3 second address: 00000000055705D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, B9h 0x0000000f popad 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055705D9 second address: 00000000055705DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055705DF second address: 00000000055705F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ecx, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055705F0 second address: 0000000005570601 instructions: 0x00000000 rdtsc 0x00000002 mov cx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov edx, 4BD8283Eh 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500C4B second address: 0000000005500C51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500C51 second address: 0000000005500C91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FCF9C692A0Dh 0x00000014 or ch, FFFFFFB6h 0x00000017 jmp 00007FCF9C692A11h 0x0000001c popfd 0x0000001d mov ecx, 5B3281A7h 0x00000022 popad 0x00000023 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500C91 second address: 0000000005500CB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 11C12BB5h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FCF9D483127h 0x00000015 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500CB8 second address: 0000000005500CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500CBE second address: 0000000005500CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500CC2 second address: 0000000005500CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c jmp 00007FCF9C692A0Dh 0x00000011 mov dh, ah 0x00000013 popad 0x00000014 push dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500CE7 second address: 0000000005500CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500CEB second address: 0000000005500CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500CEF second address: 0000000005500CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005500CF5 second address: 0000000005500D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9C692A0Ah 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570381 second address: 00000000055703CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCF9D483126h 0x0000000f push eax 0x00000010 jmp 00007FCF9D48311Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FCF9D483125h 0x0000001d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055703CB second address: 0000000005570415 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FCF9C692A0Eh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FCF9C692A0Eh 0x00000018 xor al, FFFFFFC8h 0x0000001b jmp 00007FCF9C692A0Bh 0x00000020 popfd 0x00000021 push eax 0x00000022 push edx 0x00000023 movzx ecx, bx 0x00000026 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D59 second address: 0000000005540D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D5D second address: 0000000005540D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D61 second address: 0000000005540D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D67 second address: 0000000005540D6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D6D second address: 0000000005540D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D71 second address: 0000000005540D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a movzx eax, di 0x0000000d push eax 0x0000000e push edx 0x0000000f mov edi, 38A15324h 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D85 second address: 0000000005540DCC instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 0C327D90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCF9D483124h 0x00000012 adc si, D1D8h 0x00000017 jmp 00007FCF9D48311Bh 0x0000001c popfd 0x0000001d movzx esi, di 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FCF9D48311Eh 0x00000029 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540DCC second address: 0000000005540E0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov bx, cx 0x0000000f pushfd 0x00000010 jmp 00007FCF9C692A10h 0x00000015 or ch, FFFFFF98h 0x00000018 jmp 00007FCF9C692A0Bh 0x0000001d popfd 0x0000001e popad 0x0000001f pop ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 mov bh, 06h 0x00000027 popad 0x00000028 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000559000A second address: 0000000005590029 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483124h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005590029 second address: 0000000005590046 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005590046 second address: 000000000559004C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000559004C second address: 0000000005590050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005590050 second address: 0000000005590054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005590054 second address: 0000000005590097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx eax, di 0x0000000d pushfd 0x0000000e jmp 00007FCF9C692A11h 0x00000013 add ecx, 49B65EE6h 0x00000019 jmp 00007FCF9C692A11h 0x0000001e popfd 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov bx, 796Eh 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005590097 second address: 000000000559009D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000559009D second address: 00000000055900A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055900A1 second address: 00000000055900BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov eax, ebx 0x00000012 mov ecx, edi 0x00000014 popad 0x00000015 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055900BD second address: 00000000055900E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCF9C692A10h 0x00000009 or cl, 00000018h 0x0000000c jmp 00007FCF9C692A0Bh 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570D17 second address: 0000000005570D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570D1B second address: 0000000005570D38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570D38 second address: 0000000005570D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 pushfd 0x00000006 jmp 00007FCF9D483128h 0x0000000b or ah, 00000008h 0x0000000e jmp 00007FCF9D48311Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FCF9D483124h 0x0000001f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570D7F second address: 0000000005570D85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570D85 second address: 0000000005570DCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FCF9D48311Eh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov dx, 28E0h 0x0000001a jmp 00007FCF9D483129h 0x0000001f popad 0x00000020 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570DCA second address: 0000000005570DDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9C692A0Ch 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570DDA second address: 0000000005570DDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570DDE second address: 0000000005570DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov edi, esi 0x00000010 popad 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055704A5 second address: 00000000055704C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483127h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570A08 second address: 0000000005570A2C instructions: 0x00000000 rdtsc 0x00000002 mov cx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCF9C692A19h 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570A2C second address: 0000000005570A50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FCF9D48311Ch 0x00000011 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570A50 second address: 0000000005570A75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 mov di, 9CA0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007FCF9C692A10h 0x00000015 pop eax 0x00000016 movsx edi, ax 0x00000019 popad 0x0000001a rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570A75 second address: 0000000005570A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9D483128h 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570A91 second address: 0000000005570ABB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FCF9C692A15h 0x00000014 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570ABB second address: 0000000005570AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570AC1 second address: 0000000005570AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570AC5 second address: 0000000005570BAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCF9D483125h 0x00000012 and ch, FFFFFFC6h 0x00000015 jmp 00007FCF9D483121h 0x0000001a popfd 0x0000001b popad 0x0000001c and dword ptr [eax], 00000000h 0x0000001f pushad 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FCF9D483129h 0x00000027 add esi, 0697DFD6h 0x0000002d jmp 00007FCF9D483121h 0x00000032 popfd 0x00000033 pushfd 0x00000034 jmp 00007FCF9D483120h 0x00000039 or cx, 0DF8h 0x0000003e jmp 00007FCF9D48311Bh 0x00000043 popfd 0x00000044 popad 0x00000045 call 00007FCF9D483128h 0x0000004a mov bx, cx 0x0000004d pop eax 0x0000004e popad 0x0000004f and dword ptr [eax+04h], 00000000h 0x00000053 pushad 0x00000054 mov dh, 1Eh 0x00000056 pushfd 0x00000057 jmp 00007FCF9D483124h 0x0000005c adc ecx, 1EA372B8h 0x00000062 jmp 00007FCF9D48311Bh 0x00000067 popfd 0x00000068 popad 0x00000069 pop ebp 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f popad 0x00000070 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570BAA second address: 0000000005570BAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570BAE second address: 0000000005570BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540C42 second address: 0000000005540C5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540C5D second address: 0000000005540C63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540C63 second address: 0000000005540C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540C67 second address: 0000000005540C90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D48311Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FCF9D483125h 0x00000013 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540C90 second address: 0000000005540CA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 444AC362h 0x00000008 movsx ebx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540CA5 second address: 0000000005540CA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540CA9 second address: 0000000005540CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540CAF second address: 0000000005540D02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FCF9D48311Fh 0x00000009 and eax, 4AE8A10Eh 0x0000000f jmp 00007FCF9D483129h 0x00000014 popfd 0x00000015 mov bl, cl 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FCF9D483123h 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D02 second address: 0000000005540D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dh, A2h 0x00000006 popad 0x00000007 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D09 second address: 0000000005540D0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540D0F second address: 0000000005540D13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570E42 second address: 0000000005570EA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483126h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FCF9D483120h 0x0000000f push eax 0x00000010 jmp 00007FCF9D48311Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 mov cx, E4CBh 0x0000001b mov bx, si 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FCF9D483129h 0x00000028 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570EA0 second address: 0000000005570EBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570EBC second address: 0000000005570EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570EC0 second address: 0000000005570EC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005570EC4 second address: 0000000005570ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005520903 second address: 0000000005520909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005520909 second address: 000000000552090D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000552090D second address: 0000000005520923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCF9C692A0Bh 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005520923 second address: 000000000552096A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483129h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007FCF9D48311Eh 0x00000011 mov ebp, esp 0x00000013 jmp 00007FCF9D483120h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000552096A second address: 0000000005520970 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005520970 second address: 0000000005520976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005520976 second address: 000000000552097A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580A22 second address: 0000000005580A39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483123h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580A39 second address: 0000000005580A63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx ecx, bx 0x00000010 mov ebx, 727C8E8Ah 0x00000015 popad 0x00000016 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580A63 second address: 0000000005580A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FCF9D483127h 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580A7E second address: 0000000005580ABF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FCF9C692A0Eh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 call 00007FCF9C692A0Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580ABF second address: 0000000005580AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, edx 0x00000007 popad 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FCF9D48311Fh 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580AD9 second address: 0000000005580B60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ecx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FCF9C692A0Ch 0x00000013 or ecx, 643499C8h 0x00000019 jmp 00007FCF9C692A0Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007FCF9C692A18h 0x00000025 or ax, 9C28h 0x0000002a jmp 00007FCF9C692A0Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov eax, dword ptr [775165FCh] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FCF9C692A15h 0x0000003d rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580B60 second address: 0000000005580B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580B66 second address: 0000000005580B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580B6A second address: 0000000005580BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483123h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d jmp 00007FCF9D483126h 0x00000012 je 00007FD00F395EE1h 0x00000018 pushad 0x00000019 movzx esi, dx 0x0000001c pushad 0x0000001d movsx edi, si 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580BAB second address: 0000000005580C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ecx, eax 0x00000008 jmp 00007FCF9C692A0Eh 0x0000000d xor eax, dword ptr [ebp+08h] 0x00000010 pushad 0x00000011 mov ebx, 78737742h 0x00000016 pushfd 0x00000017 jmp 00007FCF9C692A13h 0x0000001c or ax, AE3Eh 0x00000021 jmp 00007FCF9C692A19h 0x00000026 popfd 0x00000027 popad 0x00000028 and ecx, 1Fh 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FCF9C692A0Dh 0x00000032 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580C10 second address: 0000000005580C54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCF9D48311Ch 0x00000012 or ax, ED98h 0x00000017 jmp 00007FCF9D48311Bh 0x0000001c popfd 0x0000001d mov di, cx 0x00000020 popad 0x00000021 leave 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 movsx edx, ax 0x0000002a popad 0x0000002b rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580C54 second address: 0000000005580C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000558009F second address: 00000000055800A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055800A3 second address: 00000000055800A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055800A7 second address: 00000000055800AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055800AD second address: 00000000055800B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055800B3 second address: 000000000558012C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FCF9D48311Dh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FCF9D48311Eh 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FCF9D48311Dh 0x0000001d or ah, 00000006h 0x00000020 jmp 00007FCF9D483121h 0x00000025 popfd 0x00000026 popad 0x00000027 mov eax, dword ptr [ebp+08h] 0x0000002a pushad 0x0000002b movzx eax, di 0x0000002e mov eax, edx 0x00000030 popad 0x00000031 and dword ptr [eax], 00000000h 0x00000034 jmp 00007FCF9D48311Bh 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FCF9D483120h 0x00000043 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000558012C second address: 0000000005580130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580130 second address: 0000000005580136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005580136 second address: 000000000558013C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000558013C second address: 0000000005580140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540008 second address: 0000000005540025 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9C692A19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540025 second address: 0000000005540072 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FCF9D483121h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov di, cx 0x0000000e mov si, E05Fh 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 mov edi, 6E8391D6h 0x0000001a mov esi, edi 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f mov dl, CEh 0x00000021 push eax 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007FCF9D48311Eh 0x00000029 xor ch, FFFFFFF8h 0x0000002c jmp 00007FCF9D48311Bh 0x00000031 popfd 0x00000032 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540072 second address: 0000000005540082 instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop edi 0x0000000f popad 0x00000010 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540082 second address: 0000000005540088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 0000000005540088 second address: 000000000554008C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 000000000554008C second address: 00000000055400C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FCF9D483126h 0x00000012 and si, 54B8h 0x00000017 jmp 00007FCF9D48311Bh 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ecx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRDTSC instruction interceptor: First address: 00000000055400C8 second address: 00000000055400CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                        Tries to evade debugger and weak emulator (self modifying code)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSpecial instruction interceptor: First address: 0000000000B8DCD7 instructions caused by: Self-modifying code
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSpecial instruction interceptor: First address: 0000000000B8DBEE instructions caused by: Self-modifying code
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSpecial instruction interceptor: First address: 0000000000D3201C instructions caused by: Self-modifying code
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSpecial instruction interceptor: First address: 0000000000D307AC instructions caused by: Self-modifying code
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSpecial instruction interceptor: First address: 0000000000D58EBF instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000003EDCD7 instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000003EDBEE instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 000000000059201C instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000005907AC instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeSpecial instruction interceptor: First address: 00000000005B8EBF instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000A0DCD7 instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000A0DBEE instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000BB201C instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000BB07AC instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeSpecial instruction interceptor: First address: 0000000000BD8EBF instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSpecial instruction interceptor: First address: 0000000000E2BABC instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSpecial instruction interceptor: First address: 0000000000FD8707 instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSpecial instruction interceptor: First address: 0000000001001B4F instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSpecial instruction interceptor: First address: 0000000000E0D951 instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSpecial instruction interceptor: First address: 0000000000FB94A8 instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeSpecial instruction interceptor: First address: 00000000010626BD instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeSpecial instruction interceptor: First address: 000000000105060E instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 000000000014BABC instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 00000000002F8707 instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 0000000000321B4F instructions caused by: Self-modifying code
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeSpecial instruction interceptor: First address: 00000000003826BD instructions caused by: Self-modifying code
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeMemory allocated: 57C0000 memory reserve | memory write watch
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeMemory allocated: 5960000 memory reserve | memory write watch
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeMemory allocated: 7960000 memory reserve | memory write watch
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeThread delayed: delay time: 922337203685477
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 697Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 675Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 6721Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 676Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 650Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1482
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1545
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1640
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1580
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeWindow / User API: threadDelayed 1696
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeWindow / User API: threadDelayed 4335
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\ladas[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\8PXzAAoEBuHCTzP4RBWU.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\IDzOFuKIaHRpmM4TfCyF.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\BzN7a4ewVcXrTgzQjQz2.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\well[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\plaza[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\plaza[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\plaza[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\well[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\well[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\KxZFCNaRhrDevdKhe6iU.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HhXfzERnI4EYVEjNyANc.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\3rOLtV34Ut0fTkzynGHi.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ladas[1].exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\zFHlx6IqQx3xR1F02yH2.exeJump to dropped file
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\WWQdc6vczGf1JWs0hh6W.exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\ladas[1].exeJump to dropped file
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeEvasive API call chain: RegOpenKey,DecisionNodes,ExitProcessgraph_0-58266
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe TID: 5608Thread sleep time: -36000s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe TID: 4920Thread sleep count: 94 > 30Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe TID: 3528Thread sleep time: -34017s >= -30000sJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe TID: 4920Thread sleep count: 78 > 30Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe TID: 5556Thread sleep time: -34017s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1500Thread sleep time: -46023s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4996Thread sleep count: 697 > 30Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4996Thread sleep time: -1394697s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7244Thread sleep time: -52000s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1644Thread sleep count: 675 > 30Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1644Thread sleep time: -1350675s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1464Thread sleep count: 6721 > 30Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1464Thread sleep time: -13448721s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3964Thread sleep count: 37 > 30Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 3964Thread sleep time: -74037s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1308Thread sleep time: -40020s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1628Thread sleep count: 676 > 30Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1628Thread sleep time: -1352676s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2756Thread sleep count: 650 > 30Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 2756Thread sleep time: -1300650s >= -30000sJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4808Thread sleep count: 206 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4808Thread sleep time: -412206s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4788Thread sleep count: 179 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4788Thread sleep time: -358179s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 7248Thread sleep time: -52000s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5264Thread sleep count: 1482 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 5264Thread sleep time: -2965482s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6896Thread sleep count: 1545 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6896Thread sleep time: -3091545s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6652Thread sleep count: 1640 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 6652Thread sleep time: -3281640s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4940Thread sleep count: 1580 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4940Thread sleep time: -3161580s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4936Thread sleep count: 1696 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 4936Thread sleep time: -3393696s >= -30000s
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1836Thread sleep count: 198 > 30
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exe TID: 1836Thread sleep time: -396198s >= -30000s
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 7416Thread sleep count: 109 > 30
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe TID: 7840Thread sleep time: -43350s >= -30000s
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe TID: 8728Thread sleep count: 77 > 30
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe TID: 8272Thread sleep time: -922337203685477s >= -30000s
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeThread sleep count: Count: 4335 delay: -10
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile Volume queried: C:\ FullSizeInformation
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A4C000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,0_2_00A4C000
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B1B005 recv,FindFirstFileExW,0_2_00B1B005
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002AC000 FindFirstFileA,FindNextFileA,SetFileAttributesA,RemoveDirectoryA,__Mtx_unlock,6_2_002AC000
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_0037B005 recv,FindFirstFileExW,6_2_0037B005
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeThread delayed: delay time: 922337203685477
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\AppData
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\AppData\Local\Temp
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\Desktop\desktop.ini
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\AppData\Local
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeFile opened: C:\Users\user\Documents\desktop.ini
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1652691922.0000000006631000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"aad_sso_algo_state":1,"first_profile_key":"Default","msa_first_profile_key":"Default","msa_sso_algo_state":1},"signin_last_seen_version":"117.0.2045.47","signin_last_updated_time":1696493841.488773},"sentinel_creation_time":"13340967441490675","smartscreen":{"enabled":true,"pua_protection_enabled":false},"startup_boost":{"default_last_launch":true,"last_browser_open_time":"13340967441556681"},"subresource_filter":{"ruleset_version":{"checksum":2134042798,"content":"10.34.0.50","format":36}},"tab_stats":{"discards_external":0,"discards_proactive":0,"discards_urgent":0,"last_daily_sample":"13340967441401382","reloads_external":0,"reloads_urgent":0},"telemetry_client":{"cloned_install":{"user_data_dir_id":489683},"host_telclient_path":"QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblwxMTcuMC4yMDQ1LjQ3XHRlbGNsaWVudC5kbGw=","install_source_name":"windows","os_integration_level":5,"sample_id":31256164,"updater_version":"1.3.177.11","windows_update_applied":false},"ukm":{"persisted_logs":[]},"uninstall_metrics":{"installation_date2":"1696493841"},"updateclientdata":{"apps":{"ahmaebgpfccdhgidjaidaoojjcijckba":{"cohort":"rrf@0.15","cohortname":"","installdate":-1},"alpjnmnfbgfkmmpcfpejmmoebdndedno":{"cohort":"rrf@0.55","cohortname":"","fp":"1.8F202CFB86D1EF0B5FE116718DFEDB375BB50534A1D45F02FC95BD099FDC183F","installdate":-1,"pv":"7.0.0.0"},"cllppcmmlnkggcmljjfigkcigaajjmid":{"cohort":"rrf@0.43","cohortname":"","fp":"1.D38C6AADB3F9B92410AE822CBD205272ACA28CC7C816A444EA0B795112CF98D9","installdate":-1,"pv":"116.16385.16360.19"},"ebkkldgijmkljgglkajkjgedfnigiakk":{"cohort":"rrf@0.79","cohortname":"","fp":"1.1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03","installdate":-1,"pv":"1.0.0.20"},"eeobbhfgfagbclfofmgbdfoicabjdbkn":{"cohort":"rrf@0.41","cohortname":"","fp":"1.8BFD50D350D47445B57BB1
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1964588464.0000000000D72000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000$$
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ccount.microsoft.com/profileVMware20,11696494690u
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: pageformVMware20,11696494690
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001412000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@mE
                        Source: MPGPH131.exe, 00000007.00000003.1964588464.0000000000D7A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_49CB2D5F
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696494690d
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696494690u
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061C4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000008.00000002.1939358806.0000000001540000.00000004.00000020.00020000.00000000.sdmp, RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CT name, value FROM autofillmain'.sqlite_masterr global passwords blocklistVMware20,11696494690
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1591362920.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ra Change Transaction PasswordVMware20,11696494690
                        Source: RageMP131.exe, 00000014.00000003.1942413172.0000000001423000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: dHERKKd2xGPyY5Ssqp_N.exe, 0000002A.00000003.2027837840.0000000000942000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yu
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607245468.0000000006631000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}"aad_sso_algo_state":1,"first_profile_key":"Default","msa_first_profile_key":"Default","msa_sso_algo_state":1},"signin_last_seen_version":"117.0.2045.47","signin_last_updated_time":1696493841.488773},"sentinel_creation_time":"13340967441490675","smartscreen":{"enabled":true,"pua_protection_enabled":false},"startup_boost":{"default_last_launch":true,"last_browser_open_time":"13340967441556681"},"subresource_filter":{"ruleset_version":{"checksum":2134042798,"content":"10.34.0.50","format":36}},"tab_stats":{"discards_external":0,"discards_proactive":0,"discards_urgent":0,"last_daily_sample":"13340967441401382","reloads_external":0,"reloads_urgent":0},"telemetry_client":{"cloned_install":{"user_data_dir_id":489683},"host_telclient_path":"QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHBsaWNhdGlvblwxMTcuMC4yMDQ1LjQ3XHRlbGNsaWVudC5kbGw=","install_source_name":"windows","os_integration_level":5,"sample_id":31256164,"updater_version":"1.3.177.11","windows_update_applied":false},"ukm":{"persisted_logs":[]},"uninstall_metrics":{"installation_date2":"1696493841"},"updateclientdata":{"apps":{"ahmaebgpfccdhgidjaidaoojjcijckba":{"cohort":"rrf@0.15","cohortname":"","installdate":-1},"alpjnmnfbgfkmmpcfpejmmoebdndedno":{"cohort":"rrf@0.55","cohortname":"","fp":"1.8F202CFB86D1EF0B5FE116718DFEDB375BB50534A1D45F02FC95BD099FDC183F","installdate":-1,"pv":"7.0.0.0"},"cllppcmmlnkggcmljjfigkcigaajjmid":{"cohort":"rrf@0.43","cohortname":"","fp":"1.D38C6AADB3F9B92410AE822CBD205272ACA28CC7C816A444EA0B795112CF98D9","installdate":-1,"pv":"116.16385.16360.19"},"ebkkldgijmkljgglkajkjgedfnigiakk":{"cohort":"rrf@0.79","cohortname":"","fp":"1.1B2BA8FC90BA68CD057B9CAAFFC218EAD59A23E37F79192ED37D0C3A7A8BAB03","installdate":-1,"pv":"1.0.0.20"},"eeobbhfgfagbclfofmgbdfoicabjdbkn":{"cohort":"rrf@0.41","cohortname":"","fp":"1.8BFD50D350D47445B57BB1c^
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696494690o
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1591362920.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,1169649469(
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: comVMware20,11696494690o
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HARtive Brokers - non-EU EuropeVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696hj
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696494690t
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: o.inVMware20,11696494690~
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696494690x
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696494690}
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696494690]
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696494690x
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: eVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696494690|UE
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2551836626.0000000000573000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.1906034356.0000000000B93000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000014.00000002.2090365340.0000000000B93000.00000040.00000001.01000000.00000006.sdmp, dHERKKd2xGPyY5Ssqp_N.exe, 0000002A.00000002.2085902115.0000000000FB4000.00000040.00000001.01000000.0000000E.sdmp, MSIUpdaterV131.exe, 0000002B.00000002.2258014604.0000000000ABD000.00000004.00000020.00020000.00000000.sdmp, MSIUpdaterV131.exe, 0000002B.00000002.2099613443.00000000002D4000.00000040.00000001.01000000.0000000F.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001412000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696494690f
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696494690s
                        Source: RageMP131.exe, 00000014.00000003.1942413172.0000000001423000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tive Brokers - non-EU EuropeVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000C90000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW0
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,116
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696494690t
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696494690}
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607245468.0000000006643000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_49CB2D5F\U
                        Source: MPGPH131.exe, 00000007.00000003.1548804229.0000000000CCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696494690x
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
                        Source: RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW1{
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1591362920.0000000006591000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,116964940
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696494690h
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607245468.0000000006643000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&0000001lYPSsbzi2lM9kBLMDeySzGBx45nrC8zUE0MX+HUc1Q5CE+zgCCUUV9lQSeyP4OMUzP2x44dh2ptxvH8RYkyxvRqrAQbY0zDwflQLV32L/WiZ6CMDtSY0mjJDUPIbi9c1P8lGXoRlnuxakxYy2a0c=_/uMNoER/9pD2h3Kq19wy5TOobYwsP/SldTt3n0celPM=* NULL
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696494
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: formVMware20,11696494690
                        Source: MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}bkep=
                        Source: MPGPH131.exe, 00000007.00000003.1657678294.0000000005CD6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696494690j
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rootpagecomVMware20,11696494690o
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,1169649469
                        Source: RageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWen-GBn-
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmp, MPGPH131.exe, 00000007.00000002.2551836626.0000000000573000.00000040.00000001.01000000.00000005.sdmp, RageMP131.exe, 00000008.00000002.1906034356.0000000000B93000.00000040.00000001.01000000.00000006.sdmp, RageMP131.exe, 00000014.00000002.2090365340.0000000000B93000.00000040.00000001.01000000.00000006.sdmp, dHERKKd2xGPyY5Ssqp_N.exe, 0000002A.00000002.2085902115.0000000000FB4000.00000040.00000001.01000000.0000000E.sdmp, MSIUpdaterV131.exe, 0000002B.00000002.2099613443.00000000002D4000.00000040.00000001.01000000.0000000F.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,11696494690
                        Source: MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW_jd
                        Source: RageMP131.exe, 00000008.00000002.1939358806.0000000001540000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
                        Source: MPGPH131.exe, 00000007.00000003.1653319486.0000000005CCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: r global passwords blocklistVMware20,11696494690
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeSystem information queried: ModuleInformationJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess information queried: ProcessInformationJump to behavior

                        Anti Debugging

                        barindex
                        Hides threads from debuggers
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeThread information set: HideFromDebuggerJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebuggerJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeThread information set: HideFromDebugger
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebugger
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeThread information set: HideFromDebugger
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeThread information set: HideFromDebugger
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeThread information set: HideFromDebugger
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeThread information set: HideFromDebugger
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeThread information set: HideFromDebugger
                        Tries to detect sandboxes and other dynamic analysis tools (window names)
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: regmonclass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: gbdyllo
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: procmon_window_class
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: ollydbg
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: filemonclass
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeFile opened: NTICE
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeFile opened: SICE
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeFile opened: SIWVID
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess queried: DebugPortJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPortJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                        Source: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess queried: DebugPort
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00A54AB0 mov eax, dword ptr fs:[00000030h]0_2_00A54AB0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeCode function: 6_2_002B4AB0 mov eax, dword ptr fs:[00000030h]6_2_002B4AB0
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeProcess token adjusted: Debug
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeMemory allocated: page read and write | page guard
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe" Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe" Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe "C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe" Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: unknown unknownJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknownJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeProcess created: unknown unknown
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.2039399612.0000000006E85000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2382855663.0000000006A11000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.2507254460.00000000063CB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmp, RageMP131.exe, 00000008.00000002.1906034356.0000000000B93000.00000040.00000001.01000000.00000006.sdmpBinary or memory string: bNProgram Manager
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\AppData\Local\RageMP131\RageMP131.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeCode function: 0_2_00B1C92A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,0_2_00B1C92A
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                        Lowering of HIPS / PFW / Operating System Security Settings

                        barindex
                        Disable Windows Defender notifications (registry)
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeRegistry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1
                        Disable Windows Defender real time protection (registry)
                        Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1
                        Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1
                        Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\NotificationsRegistry value created: DisableNotifications 1
                        Disables Windows Defender Tamper protection
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeRegistry value created: TamperProtection 0
                        Modifies windows update settings
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
                        Source: C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

                        Stealing of Sensitive Information

                        barindex
                        Yara detected Amadeys stealer DLL
                        Source: Yara matchFile source: 43.2.MSIUpdaterV131.exe.e0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 48.2.MSIUpdaterV131.exe.e0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 42.2.dHERKKd2xGPyY5Ssqp_N.exe.dc0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000002A.00000002.2084783663.0000000000DC1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000002B.00000002.2091149221.00000000000E1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000030.00000002.2160160951.00000000000E1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
                        Source: Yara matchFile source: 00000030.00000003.2055220279.0000000004890000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000002A.00000003.1921954403.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000002B.00000003.2039950700.0000000004690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                        Yara detected RisePro Stealer
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\P52521B9kqdb74d8LejmrZT.zip, type: DROPPED
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u5VRxrmyjWYJsGnPHociwt5.zip, type: DROPPED
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\5QtvYXoJaghghg50zGLKyNk.zip, type: DROPPED
                        Found many strings related to Crypto-Wallets (likely being stolen)
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607804010.00000000015BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \ElectronCash\wallets
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1573764748.00000000015CA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Jaxx Liberty Extension
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607804010.00000000015BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Ethereum\wallets
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607804010.00000000015BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Ethereum\wallets
                        Source: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1607804010.00000000015BC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \MultiDoge\multidoge.wallet
                        Source: firefox.exe, 00000029.00000003.2024671538.000002880BFD3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: OSKeyStore
                        Tries to harvest and steal browser information (history, passwords, etc)
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENTJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.jsonJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\logins.jsonJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\signons.sqliteJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\formhistory.sqliteJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqliteJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\LocalPrefs.json
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\places.sqliteJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqliteJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\cookies.sqliteJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqliteJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kz8kl7vh.default\signons.sqliteJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENTJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
                        Tries to steal Mail credentials (via file / registry access)
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
                        Source: C:\ProgramData\MPGPH131\MPGPH131.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

                        Remote Access Functionality

                        barindex
                        Yara detected RisePro Stealer
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\P52521B9kqdb74d8LejmrZT.zip, type: DROPPED
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\u5VRxrmyjWYJsGnPHociwt5.zip, type: DROPPED
                        Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\5QtvYXoJaghghg50zGLKyNk.zip, type: DROPPED

                        Mitre Att&ck Matrix

                        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                        Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                        Command and Scripting Interpreter                        		1
                        DLL Side-Loading                        		1
                        DLL Side-Loading                        		41
                        Disable or Modify Tools                        		1
                        OS Credential Dumping                        		1
                        System Time Discovery                        		Remote Services1
                        Archive Collected Data                        		1
                        Ingress Tool Transfer                        		Exfiltration Over Other Network MediumAbuse Accessibility Features
                        CredentialsDomainsDefault Accounts11
                        Scheduled Task/Job                        		11
                        Scheduled Task/Job                        		2
                        Bypass User Account Control                        		1
                        Deobfuscate/Decode Files or Information                        		LSASS Memory3
                        File and Directory Discovery                        		Remote Desktop Protocol2
                        Data from Local System                        		2
                        Encrypted Channel                        		Exfiltration Over BluetoothNetwork Denial of Service
                        Email AddressesDNS ServerDomain AccountsAt121
                        Registry Run Keys / Startup Folder                        		1
                        Extra Window Memory Injection                        		4
                        Obfuscated Files or Information                        		Security Account Manager226
                        System Information Discovery                        		SMB/Windows Admin Shares1
                        Email Collection                        		SteganographyAutomated ExfiltrationData Encrypted for Impact
                        Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook12
                        Process Injection                        		12
                        Software Packing                        		NTDS1
                        Query Registry                        		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                        Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script11
                        Scheduled Task/Job                        		1
                        DLL Side-Loading                        		LSA Secrets731
                        Security Software Discovery                        		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts121
                        Registry Run Keys / Startup Folder                        		2
                        Bypass User Account Control                        		Cached Domain Credentials271
                        Virtualization/Sandbox Evasion                        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                        Extra Window Memory Injection                        		DCSync3
                        Process Discovery                        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job11
                        Masquerading                        		Proc Filesystem1
                        Application Window Discovery                        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt271
                        Virtualization/Sandbox Evasion                        		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                        IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron12
                        Process Injection                        		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet
                        behaviorgraph top1 signatures2 2 Behavior Graph ID: 1391082 Sample: SecuriteInfo.com.Trojan.Sig... Startdate: 12/02/2024 Architecture: WINDOWS Score: 100 116 Antivirus detection for URL or domain 2->116 118 Multi AV Scanner detection for dropped file 2->118 120 Multi AV Scanner detection for submitted file 2->120 122 5 other signatures 2->122 8 SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe 2 118 2->8         started        13 MPGPH131.exe 104 2->13         started        15 MPGPH131.exe 2->15         started        17 9 other processes 2->17 process3 dnsIp4 98 185.215.113.46 WHOLESALECONNECTIONSNL Portugal 8->98 100 34.117.186.192 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 8->100 102 193.233.132.62 FREE-NET-ASFREEnetEU Russian Federation 8->102 70 C:\Users\user\...\jQVZ0AI5Ls1YopKhCBc3.exe, PE32 8->70 dropped 82 17 other malicious files 8->82 dropped 144 Detected unpacking (changes PE section rights) 8->144 146 Binary is likely a compiled AutoIt script file 8->146 148 Tries to steal Mail credentials (via file / registry access) 8->148 166 4 other signatures 8->166 19 4sPiYiirBc4Eg8wqN443.exe 8->19         started        22 dHERKKd2xGPyY5Ssqp_N.exe 8->22         started        25 jQVZ0AI5Ls1YopKhCBc3.exe 8->25         started        36 4 other processes 8->36 72 C:\Users\user\...\tkp2xLI98ZeXjg0exnoU.exe, PE32 13->72 dropped 74 C:\Users\user\...\r3bD9GPTMOGYxgEqy2KG.exe, PE32 13->74 dropped 76 C:\Users\user\...\HhXfzERnI4EYVEjNyANc.exe, PE32 13->76 dropped 84 9 other malicious files 13->84 dropped 150 Multi AV Scanner detection for dropped file 13->150 152 Machine Learning detection for dropped file 13->152 154 Tries to evade debugger and weak emulator (self modifying code) 13->154 86 13 other malicious files 15->86 dropped 156 Tries to harvest and steal browser information (history, passwords, etc) 15->156 158 Hides threads from debuggers 15->158 160 Tries to detect sandboxes / dynamic malware analysis system (registry check) 15->160 104 104.76.210.77 SEABONE-NETTELECOMITALIASPARKLESpAIT United States 17->104 106 18.160.60.4 MIT-GATEWAYSUS United States 17->106 108 18 other IPs or domains 17->108 78 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 17->78 dropped 80 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 17->80 dropped 162 Antivirus detection for dropped file 17->162 164 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 17->164 27 firefox.exe 17->27         started        29 msedge.exe 17->29         started        32 firefox.exe 17->32         started        34 firefox.exe 17->34         started        file5 signatures6 process7 dnsIp8 124 Detected unpacking (changes PE section rights) 19->124 126 Tries to detect sandboxes and other dynamic analysis tools (window names) 19->126 128 Modifies windows update settings 19->128 142 4 other signatures 19->142 68 C:\Users\user\AppData\Local\...\explorgu.exe, PE32 22->68 dropped 130 Tries to evade debugger and weak emulator (self modifying code) 22->130 132 Hides threads from debuggers 22->132 134 Tries to detect sandboxes / dynamic malware analysis system (registry check) 22->134 136 Multi AV Scanner detection for dropped file 25->136 138 Binary is likely a compiled AutoIt script file 25->138 38 chrome.exe 25->38         started        41 chrome.exe 25->41         started        43 chrome.exe 25->43         started        53 10 other processes 25->53 140 Found many strings related to Crypto-Wallets (likely being stolen) 27->140 110 23.34.82.79 SAUDINETSTC-ASSA United States 29->110 112 13.107.21.200 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 29->112 114 44 other IPs or domains 29->114 45 conhost.exe 36->45         started        47 conhost.exe 36->47         started        49 conhost.exe 36->49         started        51 conhost.exe 36->51         started        file9 signatures10 process11 dnsIp12 88 192.168.2.8 unknown unknown 38->88 90 239.255.255.250 unknown Reserved 38->90 55 chrome.exe 38->55         started        58 chrome.exe 41->58         started        60 chrome.exe 43->60         started        62 chrome.exe 53->62         started        64 msedge.exe 53->64         started        66 msedge.exe 53->66         started        process13 dnsIp14 92 13.107.42.14 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 55->92 94 108.177.122.84 GOOGLEUS United States 55->94 96 19 other IPs or domains 55->96

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                        windows-stand

                        Antivirus, Machine Learning and Genetic Malware Detection

                        Initial Sample

                        SourceDetectionScannerLabelLink
                        SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe47%ReversingLabsWin32.Trojan.Zusy
                        SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe100%Joe Sandbox ML

                        Dropped Files

                        SourceDetectionScannerLabelLink
                        C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe100%AviraTR/Crypt.TPM.Gen
                        C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe100%AviraTR/Crypt.TPM.Gen
                        C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe100%Joe Sandbox ML
                        C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe100%Joe Sandbox ML
                        C:\ProgramData\MPGPH131\MPGPH131.exe100%Joe Sandbox ML
                        C:\ProgramData\MPGPH131\MPGPH131.exe47%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\fu[1].exe22%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\fu[1].exe22%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ladas[1].exe45%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\plaza[1].exe39%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\ladas[1].exe45%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\plaza[1].exe39%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\well[1].exe35%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\fu[1].exe22%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\ladas[1].exe45%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\plaza[1].exe39%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\well[1].exe35%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\RageMP131\RageMP131.exe47%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\6EzL3hHTS7jbM2Oz3y4V.exe22%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\8PXzAAoEBuHCTzP4RBWU.exe39%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\WWQdc6vczGf1JWs0hh6W.exe35%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\zFHlx6IqQx3xR1F02yH2.exe45%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\3rOLtV34Ut0fTkzynGHi.exe39%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\IDzOFuKIaHRpmM4TfCyF.exe45%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\KxZFCNaRhrDevdKhe6iU.exe35%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe22%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\BzN7a4ewVcXrTgzQjQz2.exe45%ReversingLabsWin32.Trojan.Zusy
                        C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HaJpYvk8t0RJ45fl1Ifn.exe22%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HhXfzERnI4EYVEjNyANc.exe39%ReversingLabsWin32.Trojan.Generic
                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)0%ReversingLabs
                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp0%ReversingLabs

                        Unpacked PE Files

                        ⊘No Antivirus matches

                        Domains

                        ⊘No Antivirus matches

                        URLs

                        SourceDetectionScannerLabelLink
                        http://www.mozilla.com00%URL Reputationsafe
                        https://account.bellmedia.c0%URL Reputationsafe
                        http://x1.c.lencr.org/00%URL Reputationsafe
                        http://x1.i.lencr.org/00%URL Reputationsafe
                        https://mail.yahoo.co.jp/compose/?To=%s0%URL Reputationsafe
                        https://www.amazon.co.uk/0%URL Reputationsafe
                        http://185.215.113.46/mine/plaza.exe0v100%Avira URL Cloudmalware
                        http://185.215.113.46/mine/plaza.exej100%Avira URL Cloudmalware
                        https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Zbr4ZHZ4CDa4pbW1CbWfpbY7ReNxR3UIG8zInwYIFIVs9eYi0%Avira URL Cloudsafe
                        http://185.215.113.46/cost/well.exemania100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/fu.exef100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/niks.exeeidi2JNoqCa0s9_1100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/ladas.exe86100%Avira URL Cloudmalware
                        http://185.215.113.46/mine/plaza.exeb100%Avira URL Cloudmalware
                        https://www.bbc.co.uk/0%Avira URL Cloudsafe
                        https://www.youtube.com(0%Avira URL Cloudsafe
                        http://r3.o.lencr.org0%Avira URL Cloudsafe
                        http://185.215.113.46/mine/plaza.exeuu100%Avira URL Cloudmalware
                        https://accounts.google.comC:0%Avira URL Cloudsafe
                        http://www.fontbureau.comTTF0%Avira URL Cloudsafe
                        http://185.215.113.46/cost/well.exe100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/fu.exe100%Avira URL Cloudmalware
                        http://185.215.113.46/100%Avira URL Cloudmalware
                        http://crl.pki.goog/gsr1/gsr1.crl0;0%Avira URL Cloudsafe
                        http://185.215.113.46/cost/ladas.exe3100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/ladas.exeA100%Avira URL Cloudmalware
                        http://185.215.113.46/mine/amert.exeg100%Avira URL Cloudmalware
                        https://www.youtube.comC:0%Avira URL Cloudsafe
                        http://185.215.113.46/mine/amert.exeS100%Avira URL Cloudmalware
                        http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl00%Avira URL Cloudsafe
                        http://185.215.113.46/mine/plaza.exenu100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/ladas.exeT100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/ladas.exeb100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/ladas.exe17_100%Avira URL Cloudmalware
                        http://185.215.113.46/mine/plaza.exe100%Avira URL Cloudmalware
                        http://pki.goog/gsr1/gsr1.crt020%Avira URL Cloudsafe
                        http://185.215.113.46/cost/ladas.exev100%Avira URL Cloudmalware
                        http://185.215.113.46/cost/fu.exert100%Avira URL Cloudmalware
                        http://185.215.113.46/mine/plaza.exe7100%Avira URL Cloudmalware
                        http://185.215.113.46/mine/plaza.exe6100%Avira URL Cloudmalware

                        Domains and IPs

                        Contacted Domains

                        ⊘No contacted domains info

                        URLs from Memory and Binaries

                        NameSourceMaliciousAntivirus DetectionReputation
                        https://duckduckgo.com/chrome_newtabSecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          http://185.215.113.46/cost/well.exemaniaRageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmptrue
                          • Avira URL Cloud: malware
                          		unknown
                          https://duckduckgo.com/ac/?q=SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Zbr4ZHZ4CDa4pbW1CbWfpbY7ReNxR3UIG8zInwYIFIVs9eYifirefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 00000027.00000003.2560000631.000002001B2F5000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://detectportal.firefox.com/firefox.exe, 00000027.00000003.2008257223.0000020019C8E000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://185.215.113.46/cost/fu.exefMPGPH131.exe, 00000007.00000003.2341146026.0000000005CE9000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000002.2626712828.0000000005CE9000.00000004.00000020.00020000.00000000.sdmptrue
                                • Avira URL Cloud: malware
                                		unknown
                                http://www.mozilla.com0firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpfalse
                                • URL Reputation: safe
                                		unknown
                                https://addons.mozilla.org/user-media/addon_icons/954/954390-64.png?modified=97d4c956(browserSettingfirefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  https://accounts.google.com/ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%firefox.exe, 00000027.00000003.2546355697.000002001B98C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2511786855.0000020020E88000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2461439392.00000200219F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2495701203.00000200219F0000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://json-schema.org/draft/2019-09/schema.firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.fontbureau.com/designersfirefox.exe, 00000029.00000003.2674811397.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2668913323.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2647414793.000002880C48B000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2689777330.000002880C48E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000029.00000003.2692565844.000002880C48E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.fontbureau.comTTFfirefox.exe, 0000002E.00000003.2744790050.0000026D26D19000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000002E.00000003.2739730282.0000026D26D18000.00000004.00000020.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        https://www.leboncoin.fr/firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          http://185.215.113.46/cost/ladas.exe86MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmptrue
                                          • Avira URL Cloud: malware
                                          		unknown
                                          https://spocs.getpocket.com/spocsfirefox.exe, 00000027.00000003.2491387296.0000020021E48000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://addons.mozilla.org/user-media/addon_icons/784/784287-64.png?modified=mcrushedfirefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://screenshots.firefox.comfirefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.youtube.comfirefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://completion.amazon.com/search/complete?q=firefox.exe, 00000027.00000003.1883235512.0000020017300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888767017.000002001753A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889124800.0000020017557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889563330.0000020017573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://xhr.spec.whatwg.org/#sync-warningfirefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.amazon.com/exec/obidos/external-search/firefox.exe, 00000027.00000003.1911985701.00000200139B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://185.215.113.46/SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1661731813.0000000006643000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1650239381.0000000006643000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1652691922.0000000006643000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        https://www.msn.comfirefox.exe, 00000027.00000003.1952540052.0000020019CE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2008257223.0000020019CE1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://185.215.113.46/cost/niks.exeeidi2JNoqCa0s9_1MPGPH131.exe, 00000007.00000003.2341146026.0000000005CE9000.00000004.00000020.00020000.00000000.sdmptrue
                                                          • Avira URL Cloud: malware
                                                          		unknown
                                                          http://185.215.113.46/mine/plaza.exejMPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmptrue
                                                          • Avira URL Cloud: malware
                                                          		unknown
                                                          http://185.215.113.46/mine/plaza.exe0vMPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmptrue
                                                          • Avira URL Cloud: malware
                                                          		unknown
                                                          https://github.com/mozilla-services/screenshotsfirefox.exe, 00000027.00000003.1883235512.0000020017300000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888767017.000002001753A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889124800.0000020017557000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1889563330.0000020017573000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/switching-devices?utm_source=panel-deffirefox.exe, 00000027.00000003.2401787867.000002001BEE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2412407578.000002001BEB5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://json-schema.org/draft/2020-12/schema/=firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://185.215.113.46/cost/fu.exeRageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: malware
                                                                		unknown
                                                                http://185.215.113.46/mine/plaza.exebMPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                • Avira URL Cloud: malware
                                                                		unknown
                                                                https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingfirefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6lfirefox.exe, 00000027.00000003.2277107716.000002001AECB000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.amazon.com/firefox.exe, 00000027.00000003.2507147692.00000200212A6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://fpn.firefox.comfirefox.exe, 00000027.00000003.2240336859.00000200159A7000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          https://t.me/RiseProSUPPORTRageMP131.exe, 00000008.00000002.1939358806.000000000150E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://www.ecosia.org/newtab/SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638857933.0000000000D73000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1608053754.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1598861889.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1638775970.0000000000D61000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1637417280.0000000000D79000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1597873882.0000000000D79000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://www.youtube.com/firefox.exe, 00000027.00000003.2536004477.0000020020E4B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://www.youtube.com(firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		low
                                                                                https://MD8.mozilla.org/1/mfirefox.exe, 00000027.00000003.2553308884.000002001B8D8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://www.bbc.co.uk/firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  • Avira URL Cloud: safe
                                                                                  		unknown
                                                                                  https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://www.groupon.com/?utm_source=google&utm_medium=cpc&utm_campaign=us_dt_sea_ggl_txt_smp_sr_cbp_firefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://ipinfo.io/RageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://ipinfo.io:443/widget/demo/81.181.57.74RageMP131.exe, 00000014.00000002.2099369510.00000000013E8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://185.215.113.46/mine/plaza.exeuuMPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          • Avira URL Cloud: malware
                                                                                          		unknown
                                                                                          https://t.me/risepro_botRomaniaG2MPGPH131.exe, 00000007.00000002.2560943444.0000000000CEE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://accounts.google.comC:jQVZ0AI5Ls1YopKhCBc3.exe, 0000000B.00000002.2765450458.00000000001F0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000025.00000002.1816315056.000001CAC95D0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • Avira URL Cloud: safe
                                                                                            		unknown
                                                                                            https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapturefirefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              https://spocs.getpocket.com/firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://185.215.113.46/cost/well.exeRageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • Avira URL Cloud: malware
                                                                                                		unknown
                                                                                                https://www.iqiyi.com/firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://r3.o.lencr.orgfirefox.exe, 00000027.00000003.2513312990.000002001F9A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2535743839.0000020020E99000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2537031544.000002001F9A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2511786855.0000020020E99000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://crl.pki.goog/gsr1/gsr1.crl0;firefox.exe, 00000027.00000003.2542777005.000002001BCCA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: safe
                                                                                                  		unknown
                                                                                                  http://185.215.113.46/mine/amert.exegMPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: malware
                                                                                                  		unknown
                                                                                                  http://185.215.113.46/cost/ladas.exeAMPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  • Avira URL Cloud: malware
                                                                                                  		unknown
                                                                                                  http://www.inbox.lv/rfc2368/?value=%sufirefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://185.215.113.46/cost/ladas.exe3MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: malware
                                                                                                    		unknown
                                                                                                    https://www.youtube.comC:firefox.exe, 00000022.00000002.1772637061.00000231DC0C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://185.215.113.46/mine/amert.exeSRageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: malware
                                                                                                    		unknown
                                                                                                    http://crls.pki.goog/gts1c3/zdATt0Ex_Fk.crl0firefox.exe, 00000027.00000003.2515159317.000002001F924000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2538696647.000002001F924000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    http://mozilla.org/MPL/2.0/.firefox.exe, 00000027.00000003.2278677697.000002001A854000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2355399254.00000200176F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1901938072.00000200176C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2094149182.00000200176EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1905616144.00000200176AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2278677697.000002001A883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2214423557.000002001A89A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2345662599.00000200176A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2026712725.00000200176AC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1905616144.00000200176C5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2094149182.00000200176DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2549293313.000002001B937000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2077496755.0000020017691000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2298448290.000002001739A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1905553662.00000200176F1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1899966098.00000200176D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2024819623.00000200176EF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1899211633.00000200176D5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2281683178.0000020019DC9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1993999431.000002001A883000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1991165924.000002001A8AD000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://account.bellmedia.cfirefox.exe, 00000027.00000003.2559211831.000002001B820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1989729068.000002001A8E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      • URL Reputation: safe
                                                                                                      		unknown
                                                                                                      https://login.microsoftonline.comfirefox.exe, 00000027.00000003.2559211831.000002001B820000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1989729068.000002001A8E1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://crl.thawte.com/ThawteTimestampingCA.crl0firefox.exe, 00000027.00000003.2520526652.000002001F600000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839firefox.exe, 00000027.00000003.2401787867.000002001BEE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2412407578.000002001BEB5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://x1.c.lencr.org/0firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2545471085.000002001BC3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2531685400.0000020021289000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://x1.i.lencr.org/0firefox.exe, 00000027.00000003.2507147692.0000020021289000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2545471085.000002001BC3A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2531685400.0000020021289000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                            • URL Reputation: safe
                                                                                                            		unknown
                                                                                                            http://185.215.113.46/cost/ladas.exebMPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            • Avira URL Cloud: malware
                                                                                                            		unknown
                                                                                                            https://json-schema.org/draft/2019-09/schemafirefox.exe, 00000027.00000003.2549293313.000002001B937000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://185.215.113.46/cost/ladas.exeTMPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              • Avira URL Cloud: malware
                                                                                                              		unknown
                                                                                                              http://developer.mozilla.org/en/docs/DOM:element.addEventListenerfirefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://185.215.113.46/mine/plaza.exenuRageMP131.exe, 00000008.00000002.1939358806.000000000156C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: malware
                                                                                                                		unknown
                                                                                                                http://185.215.113.46/mine/plaza.exeRageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                • Avira URL Cloud: malware
                                                                                                                		unknown
                                                                                                                https://outlook.live.com/default.aspx?rru=compose&to=%sfirefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://185.215.113.46/cost/ladas.exe17_MPGPH131.exe, 00000006.00000003.2735773869.00000000061A1000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  • Avira URL Cloud: malware
                                                                                                                  		unknown
                                                                                                                  https://mail.yahoo.co.jp/compose/?To=%sfirefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  • URL Reputation: safe
                                                                                                                  		unknown
                                                                                                                  http://www.youtube.comfirefox.exe, 00000027.00000003.2447950789.0000020017D8C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpgfirefox.exe, 00000027.00000003.2475549501.0000020021EF9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2397596405.0000020021EAA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2400510109.000002001F919000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.google.com/images/branding/product/ico/googleg_lodp.icoSecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1577933294.0000000006588000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1576093941.000000000664A000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2034944261.0000000005C3F000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1895410445.0000000005C4C000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1646223753.0000000005E68000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.1651595245.0000000005C48000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2061821580.0000000005C4E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1595883527.0000000000D77000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000007.00000003.1642307545.0000000005CDD000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://www.amazon.co.uk/firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        • URL Reputation: safe
                                                                                                                        		unknown
                                                                                                                        https://screenshots.firefox.com/firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          https://www.google.com/searchfirefox.exe, 00000027.00000003.1911985701.00000200139B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1888525532.000002001751E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpgThifirefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              http://185.215.113.46/cost/ladas.exevSecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1950118970.0000000006643000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              • Avira URL Cloud: malware
                                                                                                                              		unknown
                                                                                                                              http://185.215.113.46/cost/ladas.exetMPGPH131.exe, 00000006.00000003.2735491573.0000000000D7E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://json-schema.org/draft-07/schema#-firefox.exe, 00000027.00000003.2513312990.000002001F996000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://pki.goog/gsr1/gsr1.crt02firefox.exe, 00000027.00000003.2542777005.000002001BCCA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  		unknown
                                                                                                                                  https://www.wykop.pl/firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://185.215.113.46/cost/fu.exertSecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1650239381.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1661731813.0000000006631000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe, 00000000.00000003.1652691922.0000000006631000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    • Avira URL Cloud: malware
                                                                                                                                    		unknown
                                                                                                                                    https://twitter.com/firefox.exe, 00000027.00000003.2507147692.00000200212A6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://www.olx.pl/firefox.exe, 00000027.00000003.2552897577.000002001B906000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2548874875.000002001B981000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://accounts.google.com/https://accounts.google.com/firefox.exe, 00000027.00000003.2447868408.0000020017D94000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://185.215.113.46/mine/plaza.exe6MPGPH131.exe, 00000007.00000003.2341146026.0000000005CF8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                          		unknown
                                                                                                                                          http://185.215.113.46/mine/plaza.exe7MPGPH131.exe, 00000006.00000003.2735491573.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, MPGPH131.exe, 00000006.00000003.2608514599.0000000000D7E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          • Avira URL Cloud: malware
                                                                                                                                          		unknown
                                                                                                                                          https://developer.mozilla.org/docs/Web/API/Element/setPointerCapturefirefox.exe, 00000027.00000003.1987471324.000002001B39E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://t.me/risepro_botRageMP131.exe, 00000014.00000002.2099369510.0000000001441000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://poczta.interia.pl/mh/?mailto=%sfirefox.exe, 00000027.00000003.2240336859.0000020015989000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2047286420.0000020016D30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.1893048353.0000020016D33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2288146106.0000020016D26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000027.00000003.2271612586.0000020016D2B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                		high

                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                Public IPs

                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                74.125.138.113
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                13.107.6.158
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                204.79.197.200
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                185.215.113.46
                                                                                                                                                		unknownPortugal
                                                                                                                                                		206894WHOLESALECONNECTIONSNLfalse
                                                                                                                                                172.253.124.106
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                173.194.53.40
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.217.133.10
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                173.194.219.94
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                173.194.143.137
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                34.117.237.239
                                                                                                                                                		unknownUnited States
                                                                                                                                                		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                173.194.219.154
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                18.173.166.77
                                                                                                                                                		unknownUnited States
                                                                                                                                                		3MIT-GATEWAYSUSfalse
                                                                                                                                                162.159.61.3
                                                                                                                                                		unknownUnited States
                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                173.194.7.10
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                13.107.213.41
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                40.71.99.188
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                204.79.197.239
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                31.13.88.13
                                                                                                                                                		unknownIreland
                                                                                                                                                		32934FACEBOOKUSfalse
                                                                                                                                                74.125.138.94
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                18.160.60.4
                                                                                                                                                		unknownUnited States
                                                                                                                                                		3MIT-GATEWAYSUSfalse
                                                                                                                                                34.120.208.123
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                34.120.115.102
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                64.233.177.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                1.1.1.1
                                                                                                                                                		unknownAustralia
                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                74.125.138.149
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.253.124.132
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                64.233.176.84
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.217.215.136
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                13.107.21.239
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                52.10.159.154
                                                                                                                                                		unknownUnited States
                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                34.120.158.37
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                31.13.66.19
                                                                                                                                                		unknownIreland
                                                                                                                                                		32934FACEBOOKUSfalse
                                                                                                                                                173.194.219.104
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                173.194.219.147
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                13.107.42.16
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                13.107.42.14
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                20.88.206.205
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                239.255.255.250
                                                                                                                                                		unknownReserved
                                                                                                                                                		unknownunknownfalse
                                                                                                                                                108.177.122.94
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                34.160.144.191
                                                                                                                                                		unknownUnited States
                                                                                                                                                		2686ATGS-MMD-ASUSfalse
                                                                                                                                                142.251.15.119
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                108.177.122.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                74.125.138.101
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                64.233.185.147
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                74.125.1.166
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                34.117.186.192
                                                                                                                                                		unknownUnited States
                                                                                                                                                		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                31.13.65.36
                                                                                                                                                		unknownIreland
                                                                                                                                                		32934FACEBOOKUSfalse
                                                                                                                                                172.217.135.201
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                64.233.176.94
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                152.195.19.97
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15133EDGECASTUSfalse
                                                                                                                                                13.107.21.200
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                142.250.105.154
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                34.117.188.166
                                                                                                                                                		unknownUnited States
                                                                                                                                                		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                172.217.135.170
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                64.233.177.113
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.217.215.93
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                142.250.9.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                64.233.185.119
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                108.177.122.84
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                31.13.88.35
                                                                                                                                                		unknownIreland
                                                                                                                                                		32934FACEBOOKUSfalse
                                                                                                                                                142.250.9.113
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.64.41.3
                                                                                                                                                		unknownUnited States
                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                172.217.215.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                23.209.36.201
                                                                                                                                                		unknownUnited States
                                                                                                                                                		20940AKAMAI-ASN1EUfalse
                                                                                                                                                74.125.136.94
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.217.215.113
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                142.250.105.94
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                74.125.136.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                142.250.105.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                104.76.210.77
                                                                                                                                                		unknownUnited States
                                                                                                                                                		6762SEABONE-NETTELECOMITALIASPARKLESpAITfalse
                                                                                                                                                172.253.124.119
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                34.149.100.209
                                                                                                                                                		unknownUnited States
                                                                                                                                                		2686ATGS-MMD-ASUSfalse
                                                                                                                                                172.253.124.91
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                34.107.243.93
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                193.233.132.62
                                                                                                                                                		unknownRussian Federation
                                                                                                                                                		2895FREE-NET-ASFREEnetEUfalse
                                                                                                                                                142.250.105.149
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                31.13.65.7
                                                                                                                                                		unknownIreland
                                                                                                                                                		32934FACEBOOKUSfalse
                                                                                                                                                34.107.221.82
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.253.124.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                35.244.181.201
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                23.34.82.79
                                                                                                                                                		unknownUnited States
                                                                                                                                                		25019SAUDINETSTC-ASSAfalse
                                                                                                                                                64.233.185.93
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                74.125.155.166
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                142.251.15.84
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                64.233.185.95
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                52.12.189.203
                                                                                                                                                		unknownUnited States
                                                                                                                                                		16509AMAZON-02USfalse
                                                                                                                                                23.101.168.44
                                                                                                                                                		unknownUnited States
                                                                                                                                                		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                                                                                                                                                142.250.9.102
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                74.125.136.132
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                172.217.215.84
                                                                                                                                                		unknownUnited States
                                                                                                                                                		15169GOOGLEUSfalse

                                                                                                                                                Private

                                                                                                                                                IP
                                                                                                                                                192.168.2.8
                                                                                                                                                127.0.0.1

                                                                                                                                                General Information

                                                                                                                                                Joe Sandbox version:40.0.0 Tourmaline
                                                                                                                                                Analysis ID:1391082
                                                                                                                                                Start date and time:2024-02-12 20:38:12 +01:00
                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                Overall analysis duration:0h 12m 57s
                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                Report type:full
                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                Number of analysed new started processes analysed:56
                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                Technologies:
                                                                                                                                                • HCA enabled
                                                                                                                                                • EGA enabled
                                                                                                                                                • AMSI enabled
                                                                                                                                                Analysis Mode:default
                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                Sample name:SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                Detection:MAL
                                                                                                                                                Classification:mal100.troj.spyw.evad.winEXE@183/701@0/92
                                                                                                                                                EGA Information:
                                                                                                                                                • Successful, ratio: 100%
                                                                                                                                                HCA Information:Failed
                                                                                                                                                Cookbook Comments:
                                                                                                                                                • Found application associated with file extension: .exe

                                                                                                                                                Warnings

                                                                                                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, RuntimeBroker.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                • Report size getting too big, too many NtWriteFile calls found.
                                                                                                                                                • Report size getting too big, too many NtWriteVirtualMemory calls found.
                                                                                                                                                • Skipping network analysis since amount of network traffic is too extensive
                                                                                                                                                • VT rate limit hit for: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe

                                                                                                                                                Simulations

                                                                                                                                                Behavior and APIs

                                                                                                                                                TimeTypeDescription
                                                                                                                                                20:39:22Task SchedulerRun new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                20:39:22Task SchedulerRun new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                20:39:22AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                20:39:30AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                20:39:45Task SchedulerRun new task: MSIUpdaterV131 HR path: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                20:39:47AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131 C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe
                                                                                                                                                20:39:52API Interceptor140x Sleep call for process: SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe modified
                                                                                                                                                20:39:53Task SchedulerRun new task: MSIUpdaterV131 LG path: C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                20:40:00AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV131 C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe
                                                                                                                                                20:40:09AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk
                                                                                                                                                20:40:12Task SchedulerRun new task: explorgu path: C:\Users\user\AppData\Local\Temp\00c07260dc\explorgu.exe
                                                                                                                                                20:40:17API Interceptor8x Sleep call for process: RageMP131.exe modified
                                                                                                                                                20:40:18API Interceptor370717x Sleep call for process: MPGPH131.exe modified
                                                                                                                                                20:41:07API Interceptor1x Sleep call for process: firefox.exe modified

                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                IPs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                13.107.6.158SecuriteInfo.com.Win32.TrojanX-gen.9879.13379.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                  nS2c7RHyiV.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                    file.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                      osvpYbj9SC.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                        fmoxN12Pdb.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                          file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                            6l2HJTG7zd.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                              file.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                INV-0484 #U00a323,950.00.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                  5Jrztt780M.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    204.79.197.200kr.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                    • /
                                                                                                                                                                    185.215.113.46SecuriteInfo.com.Trojan.Siggen26.6766.21437.6924.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46/cost/well.exe
                                                                                                                                                                    file.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46/cost/well.exe
                                                                                                                                                                    1cfxwHmB63.exeGet hashmaliciousAmadey, LummaC Stealer, RedLine, RisePro Stealer, XmrigBrowse
                                                                                                                                                                    • 185.215.113.46/cost/fu.exe
                                                                                                                                                                    8vPg8GbGtV.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                    file.exeGet hashmaliciousAmadey, RedLine, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46/cost/ladas.exe
                                                                                                                                                                    Bbd9GbGTz6.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, RedLine, RisePro Stealer, XmrigBrowse
                                                                                                                                                                    • 185.215.113.46/cost/fu.exe
                                                                                                                                                                    file.exeGet hashmaliciousRisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46/cost/ladas.exe

                                                                                                                                                                    Domains

                                                                                                                                                                    ⊘No context

                                                                                                                                                                    ASNs

                                                                                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                    MICROSOFT-CORP-MSN-AS-BLOCKUShttps://www.flipsnack.com/FADA7B77C6F/new-flipbook/full-view.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                    • 13.107.213.40
                                                                                                                                                                    Rendel#U00e9s_(PO5042208)_Az Idumont.htaGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                    • 13.107.139.11
                                                                                                                                                                    8BCwJHxXOp.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                    • 157.55.40.171
                                                                                                                                                                    qBS5fx5Cgi.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                    • 20.203.135.90
                                                                                                                                                                    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbU1CcXZZMzBCNGF5bWp3dml0VXZWYzE1NjI4d3xBQ3Jtc0trTnp1VG8zTHl0MzdqYTFKSjcxOVhScGo2YS1RNzk3cmk4ZWhlWDYzSzN6dEFkRDRNZnpyVUszU2Fyd1g3OWItdWdMT09XT1ctNl9LdXVBWE5MY2ZWYjRSSEszOHMzanNETWJUbnQydV9uNjlkWDdjVQ&q=http%3A%2F%2Fkilox.online/Bigge/Bigge/Bigge#Mcarden@Bigge.Com##Get hashmaliciousCaptcha Phish, HTMLPhisherBrowse
                                                                                                                                                                    • 13.107.246.35
                                                                                                                                                                    SecuriteInfo.com.Win32.TrojanX-gen.9879.13379.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 13.107.21.200
                                                                                                                                                                    http://picasa.en.softonic.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 13.107.42.14
                                                                                                                                                                    https://www.pcerror-fix.com/application-was-unable-to-start-correctly-0xc0000142Get hashmaliciousUnknownBrowse
                                                                                                                                                                    • 20.121.111.193
                                                                                                                                                                    https://rtcdk.canopusacrux.topGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 13.107.213.41
                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 13.107.22.239
                                                                                                                                                                    MICROSOFT-CORP-MSN-AS-BLOCKUShttps://www.flipsnack.com/FADA7B77C6F/new-flipbook/full-view.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                    • 13.107.213.40
                                                                                                                                                                    Rendel#U00e9s_(PO5042208)_Az Idumont.htaGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                    • 13.107.139.11
                                                                                                                                                                    8BCwJHxXOp.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                    • 157.55.40.171
                                                                                                                                                                    qBS5fx5Cgi.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                    • 20.203.135.90
                                                                                                                                                                    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbU1CcXZZMzBCNGF5bWp3dml0VXZWYzE1NjI4d3xBQ3Jtc0trTnp1VG8zTHl0MzdqYTFKSjcxOVhScGo2YS1RNzk3cmk4ZWhlWDYzSzN6dEFkRDRNZnpyVUszU2Fyd1g3OWItdWdMT09XT1ctNl9LdXVBWE5MY2ZWYjRSSEszOHMzanNETWJUbnQydV9uNjlkWDdjVQ&q=http%3A%2F%2Fkilox.online/Bigge/Bigge/Bigge#Mcarden@Bigge.Com##Get hashmaliciousCaptcha Phish, HTMLPhisherBrowse
                                                                                                                                                                    • 13.107.246.35
                                                                                                                                                                    SecuriteInfo.com.Win32.TrojanX-gen.9879.13379.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 13.107.21.200
                                                                                                                                                                    http://picasa.en.softonic.comGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 13.107.42.14
                                                                                                                                                                    https://www.pcerror-fix.com/application-was-unable-to-start-correctly-0xc0000142Get hashmaliciousUnknownBrowse
                                                                                                                                                                    • 20.121.111.193
                                                                                                                                                                    https://rtcdk.canopusacrux.topGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 13.107.213.41
                                                                                                                                                                    file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                    • 13.107.22.239
                                                                                                                                                                    WHOLESALECONNECTIONSNLSecuriteInfo.com.Trojan.Siggen26.6766.21437.6924.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    SecuriteInfo.com.Win32.TrojanX-gen.9879.13379.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    nS2c7RHyiV.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    iNuBKlGmrE.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    file.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    file.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    osvpYbj9SC.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    1cfxwHmB63.exeGet hashmaliciousAmadey, LummaC Stealer, RedLine, RisePro Stealer, XmrigBrowse
                                                                                                                                                                    • 185.215.113.32
                                                                                                                                                                    fmoxN12Pdb.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46
                                                                                                                                                                    8vPg8GbGtV.exeGet hashmaliciousAmadey, RisePro StealerBrowse
                                                                                                                                                                    • 185.215.113.46

                                                                                                                                                                    JA3 Fingerprints

                                                                                                                                                                    ⊘No context

                                                                                                                                                                    Dropped Files

                                                                                                                                                                    ⊘No context

                                                                                                                                                                    Created / dropped Files

                                                                                                                                                                    C:\ProgramData\MPGPH131\MPGPH131.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2399232
                                                                                                                                                                    Entropy (8bit):7.932723171864367
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:AtNjudw+TeIsz5y48CU+1VvWlLt0YiO7N+9k/tm5lxMTGiR9X:XCTy48CU+1VIJ0XO8uVm5/uGiH
                                                                                                                                                                    MD5:11A2A91D1B8C9B3B0784D70A78F2DA6F
                                                                                                                                                                    SHA1:5ECB42524C51DEA5E2377419F77C25ED8FEDF0B2
                                                                                                                                                                    SHA-256:A57A3B08BFB8AEC37A412A829BAF276CE0DD2782927CCC925F4509C97680EA73
                                                                                                                                                                    SHA-512:5D29BCA16E2733DEA93D571783561CBCF229C908D104EEB3F2080D59141F945534E76A9C4EE4046D91DC62F68E47902625F4215EA782F4BD9D4B0E41B7177E78
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....,.......@\...........@..........................p\......%...@.................................T...h....p.............................................................................................................. . .`..........................@....rsrc........p... ..................@....idata ............................@... .0,.......... ..............@...zcmtppku.`....@..T..."..............@...kmucpvwr.....0\......v$.............@....taggant.0...@\.."...z$.............@...........................................................................................................................................................................................

                                                                                                                                                                    C:\ProgramData\MPGPH131\MPGPH131.exe:Zone.Identifier

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):26
                                                                                                                                                                    Entropy (8bit):3.95006375643621
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                    C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_6f0e6065-626d-4198-b354-c97b95febe98.json (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8114
                                                                                                                                                                    Entropy (8bit):5.183514127361925
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:w99wMisuBcbhbVbTbfbRbObtbyEl7n3rwJA6unSrDtTkdmS73h:w9bMcNhnzFSJXrj1nSrDhkdmY
                                                                                                                                                                    MD5:26891801F28325B7EAA350F28F514AFB
                                                                                                                                                                    SHA1:03F32A5942F33BB8BF7853030AB33ACEE645B03F
                                                                                                                                                                    SHA-256:84163580E02A1C004B5588A76214C80E0E3606B110AA220DD6DD180ADC6A7A81
                                                                                                                                                                    SHA-512:8D183FA464029ADD54B17C1BFB3F5BCFAE7281EEF2ABEF5796B056956C1076BC3033BB28BDD2A14D4EC12AD40A258C3CB478866766BD676B0E6AC9BD57E6E946
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"type":"uninstall","id":"6f0e6065-626d-4198-b354-c97b95febe98","creationDate":"2024-02-12T21:39:17.652Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"965729a8-84e4-4cad-a75d-ac8181902c4b","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                    C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_6f0e6065-626d-4198-b354-c97b95febe98.json.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8114
                                                                                                                                                                    Entropy (8bit):5.183514127361925
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:w99wMisuBcbhbVbTbfbRbObtbyEl7n3rwJA6unSrDtTkdmS73h:w9bMcNhnzFSJXrj1nSrDhkdmY
                                                                                                                                                                    MD5:26891801F28325B7EAA350F28F514AFB
                                                                                                                                                                    SHA1:03F32A5942F33BB8BF7853030AB33ACEE645B03F
                                                                                                                                                                    SHA-256:84163580E02A1C004B5588A76214C80E0E3606B110AA220DD6DD180ADC6A7A81
                                                                                                                                                                    SHA-512:8D183FA464029ADD54B17C1BFB3F5BCFAE7281EEF2ABEF5796B056956C1076BC3033BB28BDD2A14D4EC12AD40A258C3CB478866766BD676B0E6AC9BD57E6E946
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"type":"uninstall","id":"6f0e6065-626d-4198-b354-c97b95febe98","creationDate":"2024-02-12T21:39:17.652Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"965729a8-84e4-4cad-a75d-ac8181902c4b","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                    C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: Avira, Detection: 100%
                                                                                                                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4sPiYiirBc4Eg8wqN443.exe.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe
                                                                                                                                                                    File Type:CSV text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):226
                                                                                                                                                                    Entropy (8bit):5.360398796477698
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
                                                                                                                                                                    MD5:3A8957C6382192B71471BD14359D0B12
                                                                                                                                                                    SHA1:71B96C965B65A051E7E7D10F61BEBD8CCBB88587
                                                                                                                                                                    SHA-256:282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
                                                                                                                                                                    SHA-512:76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1be0ce43-4e40-42d8-a5fc-33f68c48005a.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092356796832418
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXOmkLmZ1uEK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXZdKoRTuiVIoV
                                                                                                                                                                    MD5:3FAE48457418D4F6EB585DE83075C34B
                                                                                                                                                                    SHA1:FB68505F0677B2D3CE963F21E4E62DCA2E2E1265
                                                                                                                                                                    SHA-256:57577FC8E87BF77A064BEA31FBD9EA86326EE4AA715F1A9C9D806D2D2ACBBF75
                                                                                                                                                                    SHA-512:0074F63235828E9F4A83700B1BC9EE2822CDE8470306E71D89BFD39BC7F886E00B2145FFFF49672BC3EAF084AC61B8AB4A00E88EC2A0184A359821B79D89AD2B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\20b74f7d-d777-47b1-a9d4-96cb4a2e8304.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092352811616159
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXO1wLmZ1udK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXeMKoRTuiVIoV
                                                                                                                                                                    MD5:54C0911A90C4D8254D3BB6C4058C6277
                                                                                                                                                                    SHA1:ABF5A5D2DA58CBB368DCB4373D11B13A7054C165
                                                                                                                                                                    SHA-256:CDDA79C47F3BFB233AF806B5D918676EB2E9D5F3F71E772C42AB8CCF5BBD7E95
                                                                                                                                                                    SHA-512:99714325F2DC520818672E61C5DC080EB338A9C2A469F66D71DB298F5538DDE86DC0D6DC355EB92FB28D583576AB9FBA8A22B7CC51F5FA08636F57F144156F8F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\25eb2e68-324d-4412-91b5-a1af125476a2.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092320509276689
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXOvULmZ1udK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXgMKoRTuiVIoV
                                                                                                                                                                    MD5:F2CED73B1DDF25994B34112C8C7BA896
                                                                                                                                                                    SHA1:828E64A3C6E8B47BCB9081BE3E7E88BE1026F385
                                                                                                                                                                    SHA-256:7ACE79DCF6E46E2FA70E8D631BE601AE1FB8017696FAF0759122417316418148
                                                                                                                                                                    SHA-512:86DF50F374615E75DBE0C8AE67D35704608EA4B7A84FE01CA3FB2AE1B74DDAA0B0D984E1FA03D0F5CFEE16F1E0296E8E80C6F8662BB9E2A580CCEAD499F856F7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\35fea29b-cadc-4432-8a85-9ef39c103ae4.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44641
                                                                                                                                                                    Entropy (8bit):6.0953522740122965
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kO3LmZ1uLh3TUuN/uKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yn/tKoRTuiVIos
                                                                                                                                                                    MD5:2E8128C2235692919B7C089EE6BDBD6C
                                                                                                                                                                    SHA1:71457F6C9DA44F261CD3FB695CD13BEB6E00E952
                                                                                                                                                                    SHA-256:B44AD4CD949CBFE7FCAA9BEE1A461251678BD50EC6200EFD7C2D33A8D1F425A9
                                                                                                                                                                    SHA-512:BB342A76C041FD5FEACC36DFBC953FAE90840C80EA991FE98C13CF33F9F78FC3A86F5A62705CAC25BF346F8F7F5869B08500A3798E602DE02927FEFEDCACA119
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\427d0f65-8d9a-4893-bcba-bac10bc9a90c.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092352017998542
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXOgQLmZ1udK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXLMKoRTuiVIoV
                                                                                                                                                                    MD5:7E3210F20E1B5FDC962D25B00C049B18
                                                                                                                                                                    SHA1:16C3DE4E82358DF1BF3CAE0DF32CDA078B992007
                                                                                                                                                                    SHA-256:3FFA97E7F271254825FB9F68FC050F4C3D085645CC111AA9D10CB644F9E83308
                                                                                                                                                                    SHA-512:FDB90EC6B9097861A1880F5FD566A96D355D63FFAB29520A1BCBC9F07CA5A6664DE2394D647752B47DB1CC7DE21A3EF7720AD791D6F94000D75420256D82280F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b1e186f-0122-47db-9d5f-b228dc94b487.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092350007232491
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXOaOHLmZ1udK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXlMKoRTuiVIoV
                                                                                                                                                                    MD5:13DCFCF1B5615D5D275493E5C9CB3947
                                                                                                                                                                    SHA1:A8B147CBDD9A23A651832A68A42D3D5203FCE96F
                                                                                                                                                                    SHA-256:240530C556F9E24C6E86B08F44360532511DFE3D5B5CBF5D2FABF1FE8D6C25DF
                                                                                                                                                                    SHA-512:408B443766C80A76E76EF1C4E171735A74F5AF482D3741447C0021449FEFBC4ABC44C02444123EB678BB41E304F2FAEAA5BDB28EF748B9DEBC976635617D6F81
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5a7ffd1a-56ec-4f7c-9065-9ddc716a698d.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092363356151098
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXO7MLmZ1uEK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXcdKoRTuiVIoV
                                                                                                                                                                    MD5:6BAD4819707D68937B7E50B5B00240D2
                                                                                                                                                                    SHA1:C5863AFE2581194E984960EDE5E964E7ADEF4468
                                                                                                                                                                    SHA-256:B8CC293D1D9B674865A16A320912EE77512C1277D250457FEEBDB7C5C6B472D5
                                                                                                                                                                    SHA-512:3D5A70EAC0520CFF8A5C9FAAF0D11441B996C2D61234BEB7BB7A72D74C6460663CABF0E8403E0D53F6CD5116AA6920895752DD5E240594E6E57DA05DD4B269DD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\693e9a9b-ab7c-4824-bff0-3f0e788dc039.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\72a4ac0d-cf23-4d79-a60c-22685d9c98ae.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092326187272815
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:5DXzgWPsj/qlGJqIY8GB4xXHvULmZ1udK3D0bKuKwWE7RTupzKscDX//NPC1oV:5/Ps+wsI7yOX5MKoRTuiVIoV
                                                                                                                                                                    MD5:9514AAF38E67795B02CFF178972C35E3
                                                                                                                                                                    SHA1:A3A3A535BC571DCCC2E65BF6FF2A08231B3501D7
                                                                                                                                                                    SHA-256:20C5BA195C9A703ED597804F77F0DF105B3E5F5918163FBA657D2B668C9255DB
                                                                                                                                                                    SHA-512:BF665ED0CF6683BBB4783E98C3ECB8EB6371F27313A17F1C2CEEBFDEDED41F1C63BBCC304192F680016F71783E6CA7C29FCE48F13A19D187970EC46783F7DDF3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9b984f65-91b5-4ab0-8a7b-81bcbc5fe26a.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44681
                                                                                                                                                                    Entropy (8bit):6.09527694901843
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4xV3LmZ1udK3D0bKuKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yO6MKoRTuiVIos
                                                                                                                                                                    MD5:A5CAAF2C70CB754D92BA6C39C23EDD36
                                                                                                                                                                    SHA1:0336E22CBE9F12F9D28F3BB1486322DD6C6B57DA
                                                                                                                                                                    SHA-256:F417EE1F705D8D1A14F2B33049E06150BFB8931736A786E7F66081EB55DFEE3F
                                                                                                                                                                    SHA-512:6078C38430B067773AE23F6F0EE15660ECFA091809D8119A7A51E226A4FD104FCAA7675ECE5FAD579E53BBD43F246CB86DA68AB640102888571F3953CA6A7A72
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                    SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                    SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                    SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3::
                                                                                                                                                                    MD5:B5CFA9D6C8FEBD618F91AC2843D50A1C
                                                                                                                                                                    SHA1:2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
                                                                                                                                                                    SHA-256:BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
                                                                                                                                                                    SHA-512:BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65CA73FD-1B70.pma

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                    Entropy (8bit):0.04085445920491447
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:EV70o3tmP6raVHJXltWaLdLTTfDVg8Xb1cEIbT/hxcNyOno1gQsjl/inn8y08Tcp:a70stAV5fKfnhKzAgfl6n08T2RGOD
                                                                                                                                                                    MD5:A638E0EFD81097076EB7E79BF2A92366
                                                                                                                                                                    SHA1:EE55E940D185AB8DACE44EC4EAF99D8A78AF3B5B
                                                                                                                                                                    SHA-256:C88776C46DCD6E259A2D09E8BE5856796B60E3870F71DEC10F56F1839C8DAFB8
                                                                                                                                                                    SHA-512:7CA7D004CD22B1157978944AA4EA57ECD0927DF6C0EB4C953238B0E600E85DB27FBEEB1C24F98C5FADE92725BCAE742885D724BA927C673F454EFF3519F56A72
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...@..@...@.....C.].....@...............xb..0R..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....e.........117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?.......".fqlevj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U.>.........."....."...2...".*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z.......................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65CA73FD-2294.pma

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                    Entropy (8bit):0.0479464254456337
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:lC67i0pqtmEnOAQ5YKJPi6VBK/7+G1gsXxvTI/5EvjBzhc5N9Mf+6RQM+tzen8ys:l97i0ctLk8qCa6hMi70ze08T2RGOD
                                                                                                                                                                    MD5:E9A657C7A672503CA8E7F79EC0D76C13
                                                                                                                                                                    SHA1:153716EF7496655EF2FF493D4A0C29144077343F
                                                                                                                                                                    SHA-256:4778948CBEA1B0D0A3761FB83A9A2461B7016741A2D9B430AB727C243789F07E
                                                                                                                                                                    SHA-512:BA70D09C7BAAECFD608C7B4F7756EB546BD17416369ADB849AC2BD84DCC649AF2262A66DECB4E2EA6B7E21ADDC864612D3D0FBFD772BF37F49B617F55F8E0F4E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...@..@...@.....C.].....@................k..P[..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?.......".fqlevj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2.......

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-65CA73FF-2670.pma

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4194304
                                                                                                                                                                    Entropy (8bit):0.4775658146364173
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:ZfyKfl2v9FncaHFN7VGCNXq4Z/rv0aH4sd:cFn/FHpT3Y
                                                                                                                                                                    MD5:F9AF692AC62096A1573F361438D7C135
                                                                                                                                                                    SHA1:41BDD777B0C598CB2721BD48369E8E29349FBA66
                                                                                                                                                                    SHA-256:44FED8CDA880B935DA4A4F66100FF3D3B4B72ACEEDFAB90E96759BD03755E752
                                                                                                                                                                    SHA-512:CCDAC105DA3A1EFCAAE9799C1E251D75EAEFD36C9B4644EF1200BCA2AE4EE4D11C4EF5240A41ACBB9655E78D9EDF9C2C1E76C247F3F9F08F3421617581F14A7A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...@..@...@.....C.].....@...............P..................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB*...Windows NT..10.0.190452l..x86_64..?.......".fqlevj20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K..>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="*.:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2.............

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):280
                                                                                                                                                                    Entropy (8bit):4.195531555605597
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
                                                                                                                                                                    MD5:B43C738AB1422F16D60B4C4B49CC7DF2
                                                                                                                                                                    SHA1:98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
                                                                                                                                                                    SHA-256:C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
                                                                                                                                                                    SHA-512:07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\04b6c0db-0566-4bfe-b44c-03a66f2c2f48.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):25185
                                                                                                                                                                    Entropy (8bit):5.570647986464874
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:OconF3WPv3f4/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQ9OozrwypktuZ:OconF3WPv3f4/u1jazAoI1tm
                                                                                                                                                                    MD5:12A4E0F7A2969447747A1E72C11A75D6
                                                                                                                                                                    SHA1:94228E1C9113E8FE8D253DED85438E1ECE6DF4EA
                                                                                                                                                                    SHA-256:F9BEA89FCC99CEBAC55A497C1828BABB22DA786D50C12D1F7888C2E770F08531
                                                                                                                                                                    SHA-512:B9EBB888663F1D34DF1DA7918EB7C8C0925EA4B87824470F92652401035C4AE0E030BFAE8A9DD132C9A8316780154BFDC2308BCFE7042C668BC2D61539845CF7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\064911c9-6795-48cc-bdd8-4e9b8c16a3bc.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):14392
                                                                                                                                                                    Entropy (8bit):5.236120283081897
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9J99QTryDiooLabatSuyosQOIa34Hk93J8TfbV+Fi3LfAc2EzKastq7NIjPUhJ:st9PGoySuzsQOXMfbGqjP24KaZ7NIe
                                                                                                                                                                    MD5:E2995671DAA2BBC77E5417D1A517334D
                                                                                                                                                                    SHA1:4C2FD975BD9AE1C48BC28D0696B39F4F0377218C
                                                                                                                                                                    SHA-256:5688B5754E60F477F32DFABE055BBDA1DFE8DBFCBEDABC0AD2ACD929704EBFD2
                                                                                                                                                                    SHA-512:1FEA0E3C67947D6E0857A38C9669EA8D3524726B46D4C5247591D1FEC3B66E55D7B47B828F7571478628C639530E8E71B8F6D6CB41B2FC549804E01B81ED8ADC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0d77b4ef-8c60-413c-86c0-89714a1a32d4.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:L:L
                                                                                                                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\20a677ba-8b2c-495a-921d-8c557f7a3472.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):25186
                                                                                                                                                                    Entropy (8bit):5.570693411440451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:OconF3WPv3f//8F1+UoAYDCx9Tuqh0VfUC9xbog/OVQ9OozrwjpktujT:OconF3WPv3f//u1jazAoIGtM
                                                                                                                                                                    MD5:16F280AD9F1CAAA6488DFE1A03D97F5F
                                                                                                                                                                    SHA1:C24055C492C1D2EEEAB765772429072DF1A4EFDD
                                                                                                                                                                    SHA-256:5A50F547D60B17534826C360B3E77527C168EC443C16C28032235E799E495E69
                                                                                                                                                                    SHA-512:74347FAACEA9850661002D33AE1E4A08EEA249DA116F45AF9D21360DA8E6A859AC1453D126E2FBE3E2BBD601F2F3F8632120465ACC4778193EA47BD7AFFBD1C4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4bf03814-3e86-4586-a435-e1fe929b1ca8.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):11388
                                                                                                                                                                    Entropy (8bit):5.159807954279894
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkQ3J8TFbV+FPl9c/n6k9wEv3stq7NIjPUhJ:st9bsQOXVFbGN9cnxw83Z7NIe
                                                                                                                                                                    MD5:6E5D91284EE47D9F59E4D69CAE1426A9
                                                                                                                                                                    SHA1:15CEBFE9C627E570A35FF43678C6F779AAF33D6B
                                                                                                                                                                    SHA-256:3D401461A1B9A31F7E39A078D255E0253489EEC121465E84DA86ADC6D38BFD42
                                                                                                                                                                    SHA-512:FC056BB18C44FBD4801A6535703068BA0C5A07F8D551A2D538C8BCC0516223B8F6284D7C7C032A6DFC0C8C455BEFEC84395EF50067F25B981B28DAAC568E3679
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6c96194b-a213-46da-b7a8-80016d8bd889.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24691
                                                                                                                                                                    Entropy (8bit):5.5681674440619995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Ocon83WP03fg/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc9OgzrwlpktuC:Ocon83WP03fg/u1ja1AgIYt5
                                                                                                                                                                    MD5:768A10806A525E155D7D894DD8816642
                                                                                                                                                                    SHA1:DC840910DA53DE4B36E53799BB28E7F1E1820498
                                                                                                                                                                    SHA-256:8D4D9113611B17E550FB0CD610BB8A04F5DA437F5A10331E5255E9668844280E
                                                                                                                                                                    SHA-512:10BC2FDACB07EB6927DF412840C30C03D072929109A143009B11A2E8444B92C170AB3853EFC1A8B202504B993100D3C5A6864177F400E8253E4114A49C48361E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\772fb796-d5b9-434a-816d-bb12b58b2b74.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):115717
                                                                                                                                                                    Entropy (8bit):5.183660917461099
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                    MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                    SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                    SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                    SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\91ebb357-ce2c-4b21-bf11-5d704bd8b768.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):14255
                                                                                                                                                                    Entropy (8bit):5.234977157722326
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9J99QTryDi6oLabatSuyosQOIa34Hk93J8TfbV+Fi3dc/n6k9wE8K0stq7NIja:st9PG6ySuzsQOXMfbGqdcnxwBK0Z7NIe
                                                                                                                                                                    MD5:BC0508695A09EF1614D95FC7F87BAF99
                                                                                                                                                                    SHA1:98312578521F04339A736DF2E2585032B04B5E4D
                                                                                                                                                                    SHA-256:1FFE162643AD1C90D416292573E961656EE6BF48CDE8991A0B99744790807C8D
                                                                                                                                                                    SHA-512:51D7259551076B02DE6BC8C8479EB53F2A8FAB1CFEB3588C9D54BDE2AD87C1B98D83FC7065C8AFED4E5DFA3E08D1D5CD30773F36978E040369C36AF8005B5334
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\92bbba41-3317-46e0-9c41-d96ad02905a1.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):35446
                                                                                                                                                                    Entropy (8bit):5.558043324466927
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Olen03WPv3f1/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVj9OvzrwAzTHqKpktur:Olen03WPv3f1/u1jasAvIAzTKdtw
                                                                                                                                                                    MD5:F3950A4F6EAF83BC82D1A91F2EBD04E1
                                                                                                                                                                    SHA1:5D2185C9571273147158CF0CC213CFF1C2023BBA
                                                                                                                                                                    SHA-256:DC3CECA0164C36CD48B2388A895E3CE5B2686E44ADE82AE2D2AE13BDE0ACB247
                                                                                                                                                                    SHA-512:CF7E8DBE3FB93F6525D3B2D84B634F79AA3F6381B0226E37E5314304D1234F060540AD30B00764424C6E8326A4CCD1068E18BFE13D4C8B2620EF77B8ADF59325
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):309
                                                                                                                                                                    Entropy (8bit):5.2316094694756785
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:rWM1CHhJ23oH+Tcwtp3hBtB2KLl9Lxq2PCHhJ23oH+Tcwtp3hBWsIFUv:iAYebp3dFLjxvBYebp3eFUv
                                                                                                                                                                    MD5:BB16E0D3A2364D35ED82B470EEBB27F1
                                                                                                                                                                    SHA1:BBB6E38CF4C62584BD3384139C5E3A9588D8B28A
                                                                                                                                                                    SHA-256:0A7C5D62D72D33E912F3BACF3B0F99E1685F413DD97445B11603E884F4D08C2A
                                                                                                                                                                    SHA-512:371C257B4190856E76F71C7B3F6A5B903B5400E2A1178A8594B7A33D8D4C3430B3D93F9C0D35F90095DECCA06367E91DBEC41062776A991382F225F72122B542
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:15.983 2a94 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/02/12-20:40:16.129 2a94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1764984
                                                                                                                                                                    Entropy (8bit):5.138566361261913
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:hKPYf1qgOcIoyhdDrmdRArpENUKifYHpdb82W:hKgfoHmdq
                                                                                                                                                                    MD5:D755D9F4F58A7627D5DB269BFF30598C
                                                                                                                                                                    SHA1:E95C5E44C3C21BBF3482CC3E3D4CF0D5CCA53708
                                                                                                                                                                    SHA-256:143145C39EEFD834111A34C5A6CA6C4221E468BCBBF4AB70C5C0EE9E26A94E43
                                                                                                                                                                    SHA-512:4A3164594004151074D8E6445F60E72E39951539B6331B1AC50C63C898E5D060EEFF4AC2217D16916910027B30DE902A204BF135DAF09A634A4EF08BC189233C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...m.................DB_VERSION.1.Go..................QUERY_TIMESTAMP:arbitration_priority_list4.*.*.13340967444415546.$QUERY:arbitration_priority_list4.*.*..[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):336
                                                                                                                                                                    Entropy (8bit):5.0787496078585725
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:cVq2PCHhJ23oH+Tcwt9Eh1tIFUt8vgZmw+8IIkwOCHhJ23oH+Tcwt9Eh15LJ:cVvBYeb9Eh16FUt8vg/+8II56Yeb9Ehx
                                                                                                                                                                    MD5:1E7E309379D161CDE3175A2A71176B2E
                                                                                                                                                                    SHA1:E8CC0AADE292B8DFFB92A3F6C620C6EBE7DE2F2C
                                                                                                                                                                    SHA-256:8871511A24DA013EF4136D612FE4E7C2C128DC167B4AC836C84A0573F4D6A2C8
                                                                                                                                                                    SHA-512:9FDAF2D38A8BC0C94C1440195B538DDC9646919E5A19362735EFA06A990F3F2FFDB4375D73FA05F37B219D6B03A07733E8ABD5912072BC8758AD04213D776938
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:34.751 2d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/02/12-20:40:34.753 2d20 Recovering log #3.2024/02/12-20:40:34.801 2d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):336
                                                                                                                                                                    Entropy (8bit):5.0787496078585725
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:cVq2PCHhJ23oH+Tcwt9Eh1tIFUt8vgZmw+8IIkwOCHhJ23oH+Tcwt9Eh15LJ:cVvBYeb9Eh16FUt8vg/+8II56Yeb9Ehx
                                                                                                                                                                    MD5:1E7E309379D161CDE3175A2A71176B2E
                                                                                                                                                                    SHA1:E8CC0AADE292B8DFFB92A3F6C620C6EBE7DE2F2C
                                                                                                                                                                    SHA-256:8871511A24DA013EF4136D612FE4E7C2C128DC167B4AC836C84A0573F4D6A2C8
                                                                                                                                                                    SHA-512:9FDAF2D38A8BC0C94C1440195B538DDC9646919E5A19362735EFA06A990F3F2FFDB4375D73FA05F37B219D6B03A07733E8ABD5912072BC8758AD04213D776938
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:34.751 2d20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/02/12-20:40:34.753 2d20 Recovering log #3.2024/02/12-20:40:34.801 2d20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):28672
                                                                                                                                                                    Entropy (8bit):0.4574884430572202
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwjfBxb:TouQq3qh7z3bY2LNW9WMcU4Bxb
                                                                                                                                                                    MD5:DBE145149E305A708B5BBA5669AA3B8F
                                                                                                                                                                    SHA1:70D0D9B9A943DCCFA6D647F69277DF6093095676
                                                                                                                                                                    SHA-256:638378A93175ABC2792CE6900BB20C43C5886359EFD7444C698631A4E6EC995B
                                                                                                                                                                    SHA-512:EAE2282BFB1CB4EABE8D9E302E97D1DCEDAFC7FA0CE0A12B1443E984BBFDEEBEAE510252F2B175C70D2F1C95A332492BF738B18ED94E830914F93B77BD756A0C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10240
                                                                                                                                                                    Entropy (8bit):0.8708334089814068
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
                                                                                                                                                                    MD5:92F9F7F28AB4823C874D79EDF2F582DE
                                                                                                                                                                    SHA1:2D4F1B04C314C79D76B7FF3F50056ECA517C338B
                                                                                                                                                                    SHA-256:6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
                                                                                                                                                                    SHA-512:86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):783642
                                                                                                                                                                    Entropy (8bit):5.993465445261261
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:q14we5qoBPE3DJqN+kDrAkuWNyBSzwM+gZT/ZO5VpSHhtQXpgi9Ij7F2gpAJyoa:24h5qoBqqN19NyBVMYPpWQgi9pyb
                                                                                                                                                                    MD5:B70B8A3FB0B63F413627EA93E8D3479B
                                                                                                                                                                    SHA1:5FA09213CC685BF88EB47A94BD620CE9647E5F40
                                                                                                                                                                    SHA-256:3D325AD9C6ABC99BBC22BA3C11691D68672F1237BBF94B52BB8A3E5B9CDB24AB
                                                                                                                                                                    SHA-512:D1CCCA3E9C5C8837282DCC4EAF2E426CCD12360D9C7CC880DA6311E2472EF5874299A804A2570493ED7E753F5D0A0316DD3C3191426320D3092E7D648B19A673
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...m.................DB_VERSION.1..`..................BLOOM_FILTER:../{"numberOfHashFunctions":8,"shiftBase":9,"bloomFilterArraySize":4650295,"primeBases":[5381,5381,5381,5381],"supportedDomains":"qULs18h7z62W5bGowQtkCQaQ8Zwo0RADGPd07ROA4oAQzL4GYmLqydxX4JCCC3ivIoKOdBCPDOkkWw/iiC0skbC8xDtvA7dM6S73AjuiD+QiimyMhCjwSvXnwoP4zhq3gtf9yGwbchENXGYqxXgQYdUmNnBI5APWsHx88Hi21GXhO5M54tszI0Xg7amldqDSMf4gFJx0k4lAhPIpefu/f+bfxnU07lwBiPIJ8Ap48KAUW7/y/jGJ0V901zSl1Z+b1XyP7yHwhwOwvhZJmTE8JbpPgXkueREcqoWMJVW2vuY2CWjeoTBu2aE0Mg7CT+EsYpsC4TJlapApjAtI///vDIfA9YfYXiUA6s0Ek0ygRhpeRUlD0ijEwRBpQPdfMN4OxBU1/t3W3iYCzGk++VzTfC6YWYqaMiWD35fnE4hXX8BsE+ZsLSVs+lgnEgSlXuNi4uMF3ica7wTCYS0tgehSI2SgBoP5JkcRAEJNwHziguJ8dS3A241NIqATQ3iBiUCrHcgJFBE18H2Qm2bJZ0LHqQt4uQABpRRLEmF+eBMDJUrVbO6bCXmhKMbyRa8aI48TdgIgIXqgls4onhUdSBT9cdUn13j6jZXgDCAvyCFJGp66l58bNVOhKhdlY7lOEqAw6jQejKjCD9mjov+eUKSfjuFQIqFTS/W9/ruGi2C++7bFO63Q2qicSoSFjI5i3vu8A3wXzSDdym6ijlwiY92o28gn7mhgROJNVaTc+W05VhcDduEERB3v7fd+WSOoEvFriCg1ESZ+By5+NoyeO2WBG4cgEtIArLL/P6f

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000004.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):142
                                                                                                                                                                    Entropy (8bit):5.0354238940341185
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:UXZlt38E28xp4m3rscUSVSXXqqNa4jlf+nETPxpK2x7Llc9X9oWQf6Fis:UXbt38D8xSEsIVP2D+n0PxEWNc19oi
                                                                                                                                                                    MD5:BD1A1EB10542B9827B954428DE0694CB
                                                                                                                                                                    SHA1:45150016F8A0375E6067570420EDA36EC68B48A3
                                                                                                                                                                    SHA-256:A67EE1D43E3304E12D7924C3FFC9CFB17617D7055444323D10C198F01E3518EF
                                                                                                                                                                    SHA-512:7939D002D8A8216C8C399D835F2F0ED600FD5B34513D41536DEB5875B487A6659AF47DEE52BC0E81528768FCF3FD08DBA9A884BAA66A5A9A075577BF3C5D4FC1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.lo$9................BLOOM_FILTER_EXPIRY_TIME:.1707853211.262568..7G................BLOOM_FILTER_LAST_MODIFIED:.Mon, 12 Feb 2024 18:15:49 GMT

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000005.ldb

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):783589
                                                                                                                                                                    Entropy (8bit):5.9923433265238675
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:614we5aoNPE3XJqKNklrrkuWN6BSzHM+24T/am5TpSHytQkygibIjaF22pwJ6oU:m4h5aoNcqKF9N6BQbb1pWdgibU6p
                                                                                                                                                                    MD5:95E9DD4E586120C0815B5C2140AEFA5F
                                                                                                                                                                    SHA1:960E9087DE7A5958E90F63A9036775E9FC8245DB
                                                                                                                                                                    SHA-256:EB4D4934F8C27A03E88C361DD69017921EECFDA695CAA365401F4D7BE19FB469
                                                                                                                                                                    SHA-512:04CA07E230F486C25ACD934C62B1EDDE1F80F47558C6A1A2BB215F5DDD363D26134CD61A1B44F18DCBE4B675D716AC353A5FB99540F353D6C388A291EB23C647
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..../BLOOM_FILTER:........{"numberOfHashFunctions":8,"shiftBase":9,"bloomFilterArraySize":4650295,"primeBases":[5381,5381,5381,5381],"supportedDomains":"qULs18h7z62W5bGowQtkCQaQ8Zwo0RADGPd07ROA4oAQzL4GYmLqydxX4JCCC3ivIoKOdBCPDOkkWw/iiC0skbC8xDtvA7dM6S73AjuiD+QiimyMhCjwSvXnwoP4zhq3gtf9yGwbchENXGYqxXgQYdUmNnBI5APWsHx88Hi21GXhO5M54tszI0Xg7amldqDSMf4gFJx0k4lAhPIpefu/f+bfxnU07lwBiPIJ8Ap48KAUW7/y/jGJ0V901zSl1Z+b1XyP7yHwhwOwvhZJmTE8JbpPgXkueREcqoWMJVW2vuY2CWjeoTBu2aE0Mg7CT+EsYpsC4TJlapApjAtI///vDIfA9YfYXiUA6s0Ek0ygRhpeRUlD0ijEwRBpQPdfMN4OxBU1/t3W3iYCzGk++VzTfC6YWYqaMiWD35fnE4hXX8BsE+ZsLSVs+lgnEgSlXuNi4uMF3ica7wTCYS0tgehSI2SgBoP5JkcRAEJNwHziguJ8dS3A241NIqATQ3iBiUCrHcgJFBE18H2Qm2bJZ0LHqQt4uQABpRRLEmF+eBMDJUrVbO6bCXmhKMbyRa8aI48TdgIgIXqgls4onhUdSBT9cdUn13j6jZXgDCAvyCFJGp66l58bNVOhKhdlY7lOEqAw6jQejKjCD9mjov+eUKSfjuFQIqFTS/W9/ruGi2C++7bFO63Q2qicSoSFjI5i3vu8A3wXzSDdym6ijlwiY92o28gn7mhgROJNVaTc+W05VhcDduEERB3v7fd+WSOoEvFriCg1ESZ+By5+NoyeO2WBG4cgEtIArLL/P6fS7+NG5gARhAFkFtWnwZPwQhzjzIBSDgiVAZA99X0O33S

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):5.2184861430469125
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:oeKOvIvBYebn9GFUt8deKs1/+de/z56Yebn95Z9/Wf0nWfdGKdh:oLOyBYeb9ig8dLJ+6Yeb9z9Xneh
                                                                                                                                                                    MD5:6F377A6450DCC47F0F354C21EA8E1860
                                                                                                                                                                    SHA1:CC6385CE0501E484C5C9C05B58856FBE99EA4F6E
                                                                                                                                                                    SHA-256:E8EBC297D6CBD0B3DAD348E0CA03E3061582014B4B70065B48C784F1FC40EAB4
                                                                                                                                                                    SHA-512:6F883D590F68CB4567B195EFC873E006625B1338D80F6B2C3833687B7F012D81F01F8769D5434E583A40720FB95998ED1B839B579F622B7AB04041CE5701BCC2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.871 2710 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/02/12-20:39:44.879 2710 Recovering log #3.2024/02/12-20:39:44.891 2710 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/02/12-20:40:11.447 26e4 Level-0 table #5: started.2024/02/12-20:40:11.526 26e4 Level-0 table #5: 783589 bytes OK.2024/02/12-20:40:11.527 26e4 Delete type=0 #3.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):512
                                                                                                                                                                    Entropy (8bit):5.2184861430469125
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:oeKOvIvBYebn9GFUt8deKs1/+de/z56Yebn95Z9/Wf0nWfdGKdh:oLOyBYeb9ig8dLJ+6Yeb9z9Xneh
                                                                                                                                                                    MD5:6F377A6450DCC47F0F354C21EA8E1860
                                                                                                                                                                    SHA1:CC6385CE0501E484C5C9C05B58856FBE99EA4F6E
                                                                                                                                                                    SHA-256:E8EBC297D6CBD0B3DAD348E0CA03E3061582014B4B70065B48C784F1FC40EAB4
                                                                                                                                                                    SHA-512:6F883D590F68CB4567B195EFC873E006625B1338D80F6B2C3833687B7F012D81F01F8769D5434E583A40720FB95998ED1B839B579F622B7AB04041CE5701BCC2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.871 2710 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/02/12-20:39:44.879 2710 Recovering log #3.2024/02/12-20:39:44.891 2710 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .2024/02/12-20:40:11.447 26e4 Level-0 table #5: started.2024/02/12-20:40:11.526 26e4 Level-0 table #5: 783589 bytes OK.2024/02/12-20:40:11.527 26e4 Delete type=0 #3.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):103
                                                                                                                                                                    Entropy (8bit):5.287315490441997
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVj0zcSluhFhinC0PxFxN3erkEtl:scoBY7jKcSluGC0PxFDkHl
                                                                                                                                                                    MD5:052E4C5C02A444A13324EAB7F680CC80
                                                                                                                                                                    SHA1:3F5DDEAD01D4A4512ABE190EABB18F328FEF6B71
                                                                                                                                                                    SHA-256:5938252A171C2F6CA0BA19A408CD184A807B5515CECA755E46C6F6E4291D502A
                                                                                                                                                                    SHA-512:21ABA70C1FB28CB18E229213C478A6579ED41BB23172DBECCD2A1C33D7E3386223D7FDEF57D9BDC7E860255EAD1104D719EE0901E4CDCB61E668332D426E1C10
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator.......G..7.............../.BLOOM_FILTER:.........DB_VERSION........

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):392649
                                                                                                                                                                    Entropy (8bit):5.409297131375041
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:Mz/imDpx6WsPS6KW4Hu5MURa8q49QxxCnyEndBuHltBfdK5WNbsVEkiPqCfXtLPJ:MuJMqq49cEndBuHltBfdK5WNbsVEkiP9
                                                                                                                                                                    MD5:BE4B2800519D22696F6CE10779ADDDBA
                                                                                                                                                                    SHA1:A16BDFBF2C6DA968BC96E86C401F571C4630940C
                                                                                                                                                                    SHA-256:AC5C0F828A52A43164A1C2EE019DBB7D1589FEB002EE6359A9BC6C69FA74974F
                                                                                                                                                                    SHA-512:15F7C300D86DEA095D499781FBCA78F988C4E5E822BF4A5ACE9B3AA910198AFFE8CC66971D847728DEA071064F3A53CE120F507863EB45681F217577B7BFECF2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...m.................DB_VERSION.1....................&QUERY_TIMESTAMP:domains_config_gz2.*.*.13352240435471325..QUERY:domains_config_gz2.*.*..[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.75/asset?sv=2017-07-29&sr=c&sig=%2Fwp1fD0xo8ywYyo5yFzHEjCMobUSk%2BZ4nmFYB%2FqjsBg%3D&st=2021-01-01T00%3A00%3A00Z&se=2024-05-01T00%3A00%3A00Z&sp=r&assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":75},"hash":"EwG2gkfquexLj6u3yjHyiL4YQwdU318k1Hub+1rSDMI=","size":391864}]....}...............ASSET_VERSION:domains_config_gz.2.8.75..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko":

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):311
                                                                                                                                                                    Entropy (8bit):5.183240456324823
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:Ux4M1CHhJ23oH+Tcwtk2WwnvB2KLl2BQVq2PCHhJ23oH+Tcwtk2WwnvIFUv:c4AYebkxwnvFLEQVvBYebkxwnQFUv
                                                                                                                                                                    MD5:AC5EBE228D9354AAEED8FD551A3BAD27
                                                                                                                                                                    SHA1:F5721A9C6B91EB4C88F22BC038CDB6BAD2732F82
                                                                                                                                                                    SHA-256:EEDCBE8C9F9CFBCB4228E05E5C3D0F5C9BA7DB2F28792B8ED29916E85891AD56
                                                                                                                                                                    SHA-512:8FFF798744DADF55FEA4C61A336C2F094E457CFFD49639E96C734E7A52AC05373A189BDF648B8CB4643CF5D2457AEC74DE0A8DDB9E4539A5B7543267B22BED32
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:34.730 2d64 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/02/12-20:40:34.798 2d64 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):374810
                                                                                                                                                                    Entropy (8bit):5.396156554633273
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:dWLgimLVvUrsc6rRA81b/18jyJNjfvrfM6Rw:cLBgAg1zfv4
                                                                                                                                                                    MD5:800E64C904184C0F3C752A3A66A93A71
                                                                                                                                                                    SHA1:0F697F495632C9B625E8E6D84184DA79BAB88A8F
                                                                                                                                                                    SHA-256:ABE907C5D62E71627AACC2A3B00BA68E27A67D35C931EBC5DEE8C3206296118D
                                                                                                                                                                    SHA-512:7A45AA6997FF14635AC05B6CDF9855438BB51920286B235E01D00283F746F627B0442E61A75C200B5FCDA6FFD89D00F05D32BE1E6B2DB4E6BAEAA73DE7CF4067
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aee_config":{"ar":{"price_regex":{"ae":"(((ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(ae|aed|\\x{062F}\\x{0660}\\x{0625}\\x{0660}|\\x{062F}\\.\\x{0625}|dhs|dh)))","dz":"(((dzd|da|\\x{062F}\\x{062C})\\s*\\d{1,3})|(\\d{1,3}\\s*(dzd|da|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}|egp)\\s*\\d{1,3})|(\\d{1,3}\\s*(e\\x{00a3}|egp)))","ma":"(((mad|dhs|dh)\\s*\\d{1,3})|(\\d{1,3}\\s*(mad|dhs|dh)))","sa":"((\\d{1,3}\\s*(sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633}))|((sar\\s*\\x{fdfc}|sar|sr|\\x{fdfc}|\\.\\x{0631}\\.\\x{0633})\\s*\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})|(\\x{0623}\\x{0636}\\x{0641}\\s*\\x{0625}\\x{0644}\\x{0649}\\s*\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):380
                                                                                                                                                                    Entropy (8bit):1.8784775129881184
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                    MD5:9FE07A071FDA31327FA322B32FCA0B7E
                                                                                                                                                                    SHA1:A3E0BAE8853A163C9BB55F68616C795AAAF462E8
                                                                                                                                                                    SHA-256:E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
                                                                                                                                                                    SHA-512:9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.162642315485921
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oe0l34q2PCHhJ23oH+Tcwt8aPrqIFUt8deGRj3JZmw+deGRj3DkwOCHhJ23oH+Ts:oe0lIvBYebL3FUt8deGH/+deGV56Yebc
                                                                                                                                                                    MD5:E9E7FD3B201DADCE54ECCA5E7171F780
                                                                                                                                                                    SHA1:78A0CD6759B76CED082C7ED6DCB2BDE70FAB10BF
                                                                                                                                                                    SHA-256:3D1B621AACB8BD541CED2DE4AD0C5493BED59B219EE450BC93FB563878218CF5
                                                                                                                                                                    SHA-512:0A3F55DFC52E94F9B3E100FA9CC71E256ED7D2CCB263DDD457E557375B5E3896E3F2EE5F1A963F4EE3CC90FCB492D2B8F15ACE55D013F0C27AFAB276C2A80D92
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.902 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/02/12-20:39:44.915 25a4 Recovering log #3.2024/02/12-20:39:44.915 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.162642315485921
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oe0l34q2PCHhJ23oH+Tcwt8aPrqIFUt8deGRj3JZmw+deGRj3DkwOCHhJ23oH+Ts:oe0lIvBYebL3FUt8deGH/+deGV56Yebc
                                                                                                                                                                    MD5:E9E7FD3B201DADCE54ECCA5E7171F780
                                                                                                                                                                    SHA1:78A0CD6759B76CED082C7ED6DCB2BDE70FAB10BF
                                                                                                                                                                    SHA-256:3D1B621AACB8BD541CED2DE4AD0C5493BED59B219EE450BC93FB563878218CF5
                                                                                                                                                                    SHA-512:0A3F55DFC52E94F9B3E100FA9CC71E256ED7D2CCB263DDD457E557375B5E3896E3F2EE5F1A963F4EE3CC90FCB492D2B8F15ACE55D013F0C27AFAB276C2A80D92
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.902 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/02/12-20:39:44.915 25a4 Recovering log #3.2024/02/12-20:39:44.915 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):380
                                                                                                                                                                    Entropy (8bit):1.8784775129881184
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWW
                                                                                                                                                                    MD5:9FE07A071FDA31327FA322B32FCA0B7E
                                                                                                                                                                    SHA1:A3E0BAE8853A163C9BB55F68616C795AAAF462E8
                                                                                                                                                                    SHA-256:E02333C0359406998E3FED40B69B61C9D28B2117CF9E6C0239E2E13EC13BA7C8
                                                                                                                                                                    SHA-512:9CCE621CD5B7CFBD899ABCBDD71235776FF9FF7DEA19C67F86E7F0603F7B09CA294CC16B672B742FA9B51387B2F0A501C3446872980BCA69ADE13F2B5677601D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):328
                                                                                                                                                                    Entropy (8bit):5.1705357296740715
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oe434q2PCHhJ23oH+Tcwt865IFUt8deh3JZmw+deOyI3DkwOCHhJ23oH+Tcwt86L:oe4IvBYeb/WFUt8dehZ/+desz56Yeb/L
                                                                                                                                                                    MD5:3E04175F773FD766B51C002C4516022F
                                                                                                                                                                    SHA1:BE59CACD84312D2FE2EF6CF62D0B572315AA954F
                                                                                                                                                                    SHA-256:9E9A25104A3A16A6CC534570EE1C0DA84FC499B3877E4B16473264F211AF929A
                                                                                                                                                                    SHA-512:3B7D58607CD4D3C159006611B53FEEECDC516182FA12B621DB00BA7FC54439B7093E0D31FEA8579A179632086B9A4DE41B8B95430363DBA78C663F7BF054860D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.982 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/02/12-20:39:44.990 25a4 Recovering log #3.2024/02/12-20:39:45.002 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):328
                                                                                                                                                                    Entropy (8bit):5.1705357296740715
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oe434q2PCHhJ23oH+Tcwt865IFUt8deh3JZmw+deOyI3DkwOCHhJ23oH+Tcwt86L:oe4IvBYeb/WFUt8dehZ/+desz56Yeb/L
                                                                                                                                                                    MD5:3E04175F773FD766B51C002C4516022F
                                                                                                                                                                    SHA1:BE59CACD84312D2FE2EF6CF62D0B572315AA954F
                                                                                                                                                                    SHA-256:9E9A25104A3A16A6CC534570EE1C0DA84FC499B3877E4B16473264F211AF929A
                                                                                                                                                                    SHA-512:3B7D58607CD4D3C159006611B53FEEECDC516182FA12B621DB00BA7FC54439B7093E0D31FEA8579A179632086B9A4DE41B8B95430363DBA78C663F7BF054860D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.982 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/02/12-20:39:44.990 25a4 Recovering log #3.2024/02/12-20:39:45.002 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1140
                                                                                                                                                                    Entropy (8bit):1.8784775129881184
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
                                                                                                                                                                    MD5:914FD8DC5F9A741C6947E1AB12A9D113
                                                                                                                                                                    SHA1:6529EFE14E7B0BEA47D78B147243096408CDAAE4
                                                                                                                                                                    SHA-256:8BE3C96EE64B5D2768057EA1C4D1A70F40A0041585F3173806E2278E9300960B
                                                                                                                                                                    SHA-512:2862BF83C061414EFA2AC035FFC25BA9C4ED523B430FDEEED4974F55D4450A62766C2E799D0ACDB8269210078547048ACAABFD78EDE6AB91133E30F6B5EBFFBD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.195141739214452
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeGZ1yq2PCHhJ23oH+Tcwt8NIFUt8de53j1Zmw+de531RkwOCHhJ23oH+Tcwt8+Q:oeGZ1yvBYebpFUt8depJ/+dep1R56Yey
                                                                                                                                                                    MD5:77C34745C357CBFF7515856ED2C61A55
                                                                                                                                                                    SHA1:DCA78829653D3AF1C42FD4032B7552D67473D2B1
                                                                                                                                                                    SHA-256:751E738695E75FFE287E7F0D8F1B513AFCB99F71DDF94C23790A46C3A4ADBE7F
                                                                                                                                                                    SHA-512:55F915BBD031B72A269818FE7647EF9338E03E034BAC45F89BE2DA12AFB7E4EE1A613F241FB0FE2702FCA51C2BA034DDA23347A294473D607A96571DAF1F608D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:46.087 2770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/02/12-20:39:46.088 2770 Recovering log #3.2024/02/12-20:39:46.088 2770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.195141739214452
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeGZ1yq2PCHhJ23oH+Tcwt8NIFUt8de53j1Zmw+de531RkwOCHhJ23oH+Tcwt8+Q:oeGZ1yvBYebpFUt8depJ/+dep1R56Yey
                                                                                                                                                                    MD5:77C34745C357CBFF7515856ED2C61A55
                                                                                                                                                                    SHA1:DCA78829653D3AF1C42FD4032B7552D67473D2B1
                                                                                                                                                                    SHA-256:751E738695E75FFE287E7F0D8F1B513AFCB99F71DDF94C23790A46C3A4ADBE7F
                                                                                                                                                                    SHA-512:55F915BBD031B72A269818FE7647EF9338E03E034BAC45F89BE2DA12AFB7E4EE1A613F241FB0FE2702FCA51C2BA034DDA23347A294473D607A96571DAF1F608D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:46.087 2770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/02/12-20:39:46.088 2770 Recovering log #3.2024/02/12-20:39:46.088 2770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 13, cookie 0x8, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):28672
                                                                                                                                                                    Entropy (8bit):3.1936941188940438
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:NNP32POdOTct32KNOIIG0wHDbOg2Po1OD3+sHXzC:Hv2BTw2pIIG0wjbfOiOD3NHX
                                                                                                                                                                    MD5:4CFE1BEACB98674BAF121764ED4234C3
                                                                                                                                                                    SHA1:A8A6310AFA6CF5D3B3DA7EB7252949F45BD9E523
                                                                                                                                                                    SHA-256:DD33AD09E9B6F74C4A17759635455694389E19400F4CF52595979EF5237BD629
                                                                                                                                                                    SHA-512:DA6332987F68B5D3E144F7C224F299CA47B29878E435999E2C4CC79A533604B876365668820DD097DC448267A591EAB7148438967F083E723B47B333BD08AD3F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                    Entropy (8bit):0.8895255507412462
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:m32rOdIWgVuhH+bDo3iN0Z2TVJkXBBE3ybBM1lut32KNOP:Y2KdIpuhIU3iGAIBBE3q61g2pP
                                                                                                                                                                    MD5:E0E4A89775F5F17973801A5F47106627
                                                                                                                                                                    SHA1:5B58D1D49BA80BE5562C43114540E4AD17896202
                                                                                                                                                                    SHA-256:4914A9EFE1516DD5BB0E974DFE96D353CDA3E8CAD24F48A216105033E3BE4158
                                                                                                                                                                    SHA-512:097CFC72771B4F0CB5E234E23990A81762A940938272ED21EFACA1E97F62211C567EA19BB8E89A73DDC698199736CE77651E72720C3A3C456435C45A107A755E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1597), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):115717
                                                                                                                                                                    Entropy (8bit):5.183660917461099
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
                                                                                                                                                                    MD5:3D8183370B5E2A9D11D43EBEF474B305
                                                                                                                                                                    SHA1:155AB0A46E019E834FA556F3D818399BFF02162B
                                                                                                                                                                    SHA-256:6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
                                                                                                                                                                    SHA-512:B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45056
                                                                                                                                                                    Entropy (8bit):3.9188764014602158
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:jj9P05OQkQerkjlxP/KbtLcDhw773pLbRKToaA4gam6Ic:jdje2mlxP/NDO7tRKcrM
                                                                                                                                                                    MD5:0A5F3C097D3476B35F279186E710AC79
                                                                                                                                                                    SHA1:A72E9982DADD4ECCDE9DC12DA4A4304E40BA1F6E
                                                                                                                                                                    SHA-256:D2362406045132DECF2ED5073C77D870AE00DBF33D49BC18FA778606F2F1B609
                                                                                                                                                                    SHA-512:DBC24787DEE7BFB9AE5DFB390C5CB176179225DAE57247F298560ABCB0548357CD47D7E47AC8440575DC1C908D9118AB4980293BE0B6AE26E861E25BB96B5DBA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000001.dbtmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):634178
                                                                                                                                                                    Entropy (8bit):6.120238923984002
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:pQNYQ3Gr97vQ0iGWNDXM7fUAMxJl6aojUgBjfvA7kp3N64H+el+PxrnZHRcGPk6v:j97Z6/097pjC3374C8C3Ik0m6hA2bI
                                                                                                                                                                    MD5:45A16EA4D00C43F4E0E65DBB8F8758D7
                                                                                                                                                                    SHA1:BA922C810012838C28E39F806D8769379B891316
                                                                                                                                                                    SHA-256:9C589AA28E865212E156DE519DC94FF38EE4C5AA654ECEEED6DEAF0AB834FA58
                                                                                                                                                                    SHA-512:9EE5F7B4670364D2C381329F805CA1B53A21C3ABB5764FFED78F023A865C379182B84A0AC2C8A62453B2168A2F354D6C7D29C91D14A6158CFCD6867E1D658091
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:. ......................2......."....................................xw:hv........................K.......h.t.t.p.s._.w.w.w...y.o.u.t.u.b.e...c.o.m._.0.@.1..Y.t.I.d.b.M.e.t.a....................R.g.L.............................2.......................2........................L.................................2....d.a.t.a.b.a.s.e.s......2........a.c.t.u.a.l.N.a.m.e......2..........2..........2..........2..........2..........2.............d.a.t.a.b.a.s.e.s........2.........2...........................2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2....................2........2.......................d.a.t.a.b.a.s.e.s...... .................2.................2.................2.................2.................2.................2.................2.................2.................2.................2.................2......

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):355
                                                                                                                                                                    Entropy (8bit):5.319577523885632
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:o+BpD1CHhJ23oH+TcwtEqSAxG7RB2KLle+bQtJ1yq2PCHhJ23oH+TcwtEqSAxG7j:oOfYebXG7RFLg7J1yvBYebXG7iFUv
                                                                                                                                                                    MD5:5B0BA9923AAF1633BB639116474788D4
                                                                                                                                                                    SHA1:E663070A270EA543480A83E5D4C255B0F1230110
                                                                                                                                                                    SHA-256:A244C008422474468B418996B5B5FE7CFA242BDC29AD21026300DAFD08D36FBC
                                                                                                                                                                    SHA-512:E3B4F39DA4BE95E1F82027DF61F474482095619706F5D8CA44277D86987A60D139632E73880F491364BA02E014A64A1790DF45E0CEAC59EC4357E535BB963E0D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:53.543 2770 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb since it was missing..2024/02/12-20:39:53.575 2770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb/MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):23
                                                                                                                                                                    Entropy (8bit):4.142914673354254
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:Fdb+4Ll:Zl
                                                                                                                                                                    MD5:3FD11FF447C1EE23538DC4D9724427A3
                                                                                                                                                                    SHA1:1335E6F71CC4E3CF7025233523B4760F8893E9C9
                                                                                                                                                                    SHA-256:720A78803B84CBCC8EB204D5CF8EA6EE2F693BE0AB2124DDF2B81455DE02A3ED
                                                                                                                                                                    SHA-512:10A3BD3813014EB6F8C2993182E1FA382D745372F8921519E1D25F70D76F08640E84CB8D0B554CCD329A6B4E6DE6872328650FEFA91F98C3C0CFC204899EE824
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........idb_cmp1......

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):408
                                                                                                                                                                    Entropy (8bit):5.2558805563578055
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:EN1yvBYeb8rcHEZrELFUt87J/+71R56Yeb8rcHEZrEZSJ:W1YBYeb8nZrExg87m1D6Yeb8nZrEZe
                                                                                                                                                                    MD5:4D4ED8AE7053AB9B18B0A2BD8C94A951
                                                                                                                                                                    SHA1:502B16D8AA71198EBADF799CE13D9C31405AEA86
                                                                                                                                                                    SHA-256:306D98A80C8258FE029A396C6B8CA46F4C97F8230BF61CD5F15B0A4142D0270B
                                                                                                                                                                    SHA-512:45C0774C6810392F48560DB76E055DEBBDD9F3B476961D5430C55337D86AB27405E55760CCC606C6F8F692AA7AC05DEBE5FA7D3C5563DB446FF32EF151DB45A5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:10.794 2770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/02/12-20:40:10.796 2770 Recovering log #3.2024/02/12-20:40:10.796 2770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):408
                                                                                                                                                                    Entropy (8bit):5.2558805563578055
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:EN1yvBYeb8rcHEZrELFUt87J/+71R56Yeb8rcHEZrEZSJ:W1YBYeb8nZrExg87m1D6Yeb8nZrEZe
                                                                                                                                                                    MD5:4D4ED8AE7053AB9B18B0A2BD8C94A951
                                                                                                                                                                    SHA1:502B16D8AA71198EBADF799CE13D9C31405AEA86
                                                                                                                                                                    SHA-256:306D98A80C8258FE029A396C6B8CA46F4C97F8230BF61CD5F15B0A4142D0270B
                                                                                                                                                                    SHA-512:45C0774C6810392F48560DB76E055DEBBDD9F3B476961D5430C55337D86AB27405E55760CCC606C6F8F692AA7AC05DEBE5FA7D3C5563DB446FF32EF151DB45A5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:10.794 2770 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/02/12-20:40:10.796 2770 Recovering log #3.2024/02/12-20:40:10.796 2770 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2190
                                                                                                                                                                    Entropy (8bit):5.6748599124238766
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:G9DSHm89HGAZPE/GKyQbIDVFy9mbRHeGSq7yQQYAg5PE/g:G1SHAAZPE/eVs0bRHcqHAiPE/g
                                                                                                                                                                    MD5:A42F482E9DD12D69B026A34394B40D0F
                                                                                                                                                                    SHA1:B39FC363BD03399E8C0EFC19F54C6FE64E0D0F49
                                                                                                                                                                    SHA-256:0A72BAEF76194B11A8759EE39E8CF1E7AC0A4B6C7C083731D8D02AADFB676F1A
                                                                                                                                                                    SHA-512:160CC7024D0DFFF78F579E548AD42281F1371461CD7F1FF55667BF5E32E20577A26AFCB49EED082061763F01930E7E0455AD7634556350AB560659F69A69947E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.l.q.................VERSION.1..META:https://www.youtube.com.........|.._https://www.youtube.com..__sak..1.6_https://www.youtube.com..ytidb::LAST_RESULT_ENTRY_KEYW.{"data":{"hasSucceededOnce":true},"expiration":1710358795124,"creation":1707766795124}...=.................META:https://www.facebook.com............."_https://www.facebook.com..Session..2i1jns:1707766859537.4_https://www.facebook.com..banzai:last_storage_flush..1707766828508.2.'_https://www.facebook.com..hb_timestamp..1707766827482.1_https://www.facebook.com..signal_flush_timestamp..1707766827605.0_https://www.facebook.com..__test__1707766823702.9_https://www.facebook.com..mutex_falco_queue_critical^$^$.<_https://www.facebook.com..mutex_falco_queue_immediately^$^$.4_https://www.facebook.com..mutex_falco_queue_log^$^$..#vS............... META:https://accounts.google.com.#_https://accounts.google.com..__sak.....................META:https://www.youtube.com.............>_https://www.youtube.com..V66830ee0||::yt-player::yt-pl

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):336
                                                                                                                                                                    Entropy (8bit):5.202292874522868
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeQHUVq2PCHhJ23oH+Tcwt8a2jMGIFUt8deQJgZmw+deGd2IkwOCHhJ23oH+Tcw2:oeQ0VvBYeb8EFUt8deQJg/+deK2I56YL
                                                                                                                                                                    MD5:17E4217FBDC70045163A253FA4207645
                                                                                                                                                                    SHA1:DFE17D82CCBA9E74F44BC689132BC81A8A9BA065
                                                                                                                                                                    SHA-256:BC2D11D34A1F11D925A8AA0C33E63E454311F3B138F08F35FBB37E6857EB2CC0
                                                                                                                                                                    SHA-512:7D28F6026D67DDBE03317293EEA5B575EF7BE4FA872E8C640B4CB94FF025B78C80668B0A5591AE648B49C0810490FAD54D09F7E41D100E647709BBD4FCACAE3C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.648 2804 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/02/12-20:39:45.649 2804 Recovering log #3.2024/02/12-20:39:45.657 2804 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):336
                                                                                                                                                                    Entropy (8bit):5.202292874522868
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeQHUVq2PCHhJ23oH+Tcwt8a2jMGIFUt8deQJgZmw+deGd2IkwOCHhJ23oH+Tcw2:oeQ0VvBYeb8EFUt8deQJg/+deK2I56YL
                                                                                                                                                                    MD5:17E4217FBDC70045163A253FA4207645
                                                                                                                                                                    SHA1:DFE17D82CCBA9E74F44BC689132BC81A8A9BA065
                                                                                                                                                                    SHA-256:BC2D11D34A1F11D925A8AA0C33E63E454311F3B138F08F35FBB37E6857EB2CC0
                                                                                                                                                                    SHA-512:7D28F6026D67DDBE03317293EEA5B575EF7BE4FA872E8C640B4CB94FF025B78C80668B0A5591AE648B49C0810490FAD54D09F7E41D100E647709BBD4FCACAE3C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.648 2804 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/02/12-20:39:45.649 2804 Recovering log #3.2024/02/12-20:39:45.657 2804 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\MediaDeviceSalts

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 6, cookie 0x3, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24576
                                                                                                                                                                    Entropy (8bit):0.45963480244939214
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLiCwbvwsw9VwLwcORslcDw3wJ6UwccI5fBoKoySvEO+Yy:TxKX0wxORAmA/U1cEBoKBSvAYy
                                                                                                                                                                    MD5:AE921CB025AA766BD397EF3861EF62DB
                                                                                                                                                                    SHA1:A769532D25C59B1BBC15CF0B4616D3A02D7C1C97
                                                                                                                                                                    SHA-256:7C63D7DF3C862932B53F0D4BF2DD08439E7EC846F062CADFA95283A750F2D201
                                                                                                                                                                    SHA-512:7AA157111DA118A65146A32840B5C4200094A23670A38A655D925DF066FAEF5019809188BE542BBCB9A30BCA29A6DC3766A4715F21B120142DB1A633894BF128
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...p."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\35133526-0f43-4f00-b9fe-5ca4517077ec.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[]

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\58c8155a-dd86-4ab5-99dc-d822c203c749.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):524
                                                                                                                                                                    Entropy (8bit):5.47940329348189
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:YWyEcvXI2pcO+UAnIu3hi1rNgmh4r+UAnI8mQcaBR7N+UAnISQ:YhEWtSUk3UlG1KUUT7wUwQ
                                                                                                                                                                    MD5:08726A7CF85F518871C64626CAE1FBA5
                                                                                                                                                                    SHA1:74850CE7169710C5D158672B27CA4BC8F77D0A80
                                                                                                                                                                    SHA-256:3CF859165BDB9D4CBE72A34B62DDDA175A3C2C80215B9CECB79047BC592850F2
                                                                                                                                                                    SHA-512:B139F092B40A4FE10A6FA2E3D5F124524084CEEAE5B6BDB005ADFB021CF946E9FDE4A782D14A8122FA3A56265929896ED34811187ACE59929DFEBE05AFFC19CB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"sts":[{"expiry":1739302796.660246,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1707766796.660251},{"expiry":1739302800.970218,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1707766800.970223},{"expiry":1739302792.931893,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1707766792.931899}],"version":2}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\60dd7b9a-4660-4b20-b7a9-097876819e1e.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.4418442242308882
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:TsKLopF+SawLUO1Xj8BybdRooACxsxjuU9Xp75SxR1YLgC8DYusk2idRo55H4GE:te+Auy5iwxPU9IqgC8MuskJdi55HDE
                                                                                                                                                                    MD5:A95502DE167B3468D7317D35F8C16422
                                                                                                                                                                    SHA1:EFE39E7E8512D603AAFD2749121096F2D6A58842
                                                                                                                                                                    SHA-256:A6485CED6A2FCC794B4A4F50EC3E5B7F055E688FE23368279FA1A26820763402
                                                                                                                                                                    SHA-512:5F017683D61FC7F292B22863CB54EE0101FC1FD78666751A64AC3958E051B61784B23EF070F459A65414E65ECA6E664476237FC851E32FF47ADEFC5A84B96AF0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):36864
                                                                                                                                                                    Entropy (8bit):3.1745135220057956
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:OIEumQv8m1ccnvS6tdWt269DzC29qWRXFaZZ2IAo6KJ5QnJ4B:npXe2qC2xFywIAoVDQqB
                                                                                                                                                                    MD5:2C0D849B9B484E51A15DA0D37F8FCA84
                                                                                                                                                                    SHA1:A2433085379EC185C25B67542B894F0C3C707C82
                                                                                                                                                                    SHA-256:F31B940677DBE8EDF178170547C4CD7037C2268ED09FDB79399DF8CDE95A86CC
                                                                                                                                                                    SHA-512:2A55207AED21F182D0344E768FDFC0EF01B119613111FF5D27D175A0B1C2BE61D9572B62AA17AF09DCD3D49168A4B086D44A3EB1E49A6976A0F3EEAB04B50018
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[]

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF36a44.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[]

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):524
                                                                                                                                                                    Entropy (8bit):5.47940329348189
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:YWyEcvXI2pcO+UAnIu3hi1rNgmh4r+UAnI8mQcaBR7N+UAnISQ:YhEWtSUk3UlG1KUUT7wUwQ
                                                                                                                                                                    MD5:08726A7CF85F518871C64626CAE1FBA5
                                                                                                                                                                    SHA1:74850CE7169710C5D158672B27CA4BC8F77D0A80
                                                                                                                                                                    SHA-256:3CF859165BDB9D4CBE72A34B62DDDA175A3C2C80215B9CECB79047BC592850F2
                                                                                                                                                                    SHA-512:B139F092B40A4FE10A6FA2E3D5F124524084CEEAE5B6BDB005ADFB021CF946E9FDE4A782D14A8122FA3A56265929896ED34811187ACE59929DFEBE05AFFC19CB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"sts":[{"expiry":1739302796.660246,"host":"kYxWDeIDVgesBS02XkmPRTIpB0nkimBvKZESXctn8eA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1707766796.660251},{"expiry":1739302800.970218,"host":"nAuqgR4iEWti7SOdT3UHPl6rmZU/DeaIm38P2O2OkgA=","mode":"force-https","sts_include_subdomains":false,"sts_observed":1707766800.970223},{"expiry":1739302792.931893,"host":"8/RrMmQlCD2Gsp14wUCE1P8r7B2C5+yE0+g79IPyRsc=","mode":"force-https","sts_include_subdomains":true,"sts_observed":1707766792.931899}],"version":2}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f397b2b9-2343-41da-9c15-c38f060d405f.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[]

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):0.6949007314891732
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isal/d0dtdjiG1dMgrfNr:TLSOUOq0afDdWec9sJrl7ZWI7J5fc
                                                                                                                                                                    MD5:52DE909D04514C10D7428B67A26BBDAC
                                                                                                                                                                    SHA1:0371737559133042EBF793502ECDC403011376E4
                                                                                                                                                                    SHA-256:B05BF68A882F04103FA0F53A61974AFB591B09010DDBD5139B67B9ECE073F388
                                                                                                                                                                    SHA-512:A1A861BBE3D275229BD39E11A72D894D9838145876FB40D1E233D1637F26BD5C13FBCF329D7984E0F89C3D69D1177E0E852C47B2404AC4A161101EA6ED0C7DE0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history-journal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite Rollback Journal
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8720
                                                                                                                                                                    Entropy (8bit):0.6011992756407112
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:7+/l9b0ticqLgfQUyh2kKQUy1ymO/EGrY/49MfiDlTKQUyzn2OI1Uy1X92Ol8rAW:7+t50EbLgr0Ql/d0dtdjiG1dC
                                                                                                                                                                    MD5:04E463EB66B4BCCF0D93C763244AE439
                                                                                                                                                                    SHA1:3638B85D9FDADF7BFE032892D9C13C4842CB11ED
                                                                                                                                                                    SHA-256:2A7F54ABDCED13D5A61A961CB0803851F3E43D633BDC922586069719BCEF9FC5
                                                                                                                                                                    SHA-512:F7DD746EECD4D0C8F7C1E5BB448A7359F798ABF839AA95F0394DB709841F151D661B5AB71E08BBB360750BC0B092B7E30075336DB6C08B94C2B290DAECA6A73A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.... .c.....>.8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................k........k....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF307b2.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3449b.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3737b.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF39cae.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d3bc.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42a48.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24691
                                                                                                                                                                    Entropy (8bit):5.5681674440619995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Ocon83WP03fg/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc9OgzrwlpktuC:Ocon83WP03fg/u1ja1AgIYt5
                                                                                                                                                                    MD5:768A10806A525E155D7D894DD8816642
                                                                                                                                                                    SHA1:DC840910DA53DE4B36E53799BB28E7F1E1820498
                                                                                                                                                                    SHA-256:8D4D9113611B17E550FB0CD610BB8A04F5DA437F5A10331E5255E9668844280E
                                                                                                                                                                    SHA-512:10BC2FDACB07EB6927DF412840C30C03D072929109A143009B11A2E8444B92C170AB3853EFC1A8B202504B993100D3C5A6864177F400E8253E4114A49C48361E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF33113.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24691
                                                                                                                                                                    Entropy (8bit):5.5681674440619995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Ocon83WP03fg/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc9OgzrwlpktuC:Ocon83WP03fg/u1ja1AgIYt5
                                                                                                                                                                    MD5:768A10806A525E155D7D894DD8816642
                                                                                                                                                                    SHA1:DC840910DA53DE4B36E53799BB28E7F1E1820498
                                                                                                                                                                    SHA-256:8D4D9113611B17E550FB0CD610BB8A04F5DA437F5A10331E5255E9668844280E
                                                                                                                                                                    SHA-512:10BC2FDACB07EB6927DF412840C30C03D072929109A143009B11A2E8444B92C170AB3853EFC1A8B202504B993100D3C5A6864177F400E8253E4114A49C48361E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF36c38.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24691
                                                                                                                                                                    Entropy (8bit):5.5681674440619995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Ocon83WP03fg/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc9OgzrwlpktuC:Ocon83WP03fg/u1ja1AgIYt5
                                                                                                                                                                    MD5:768A10806A525E155D7D894DD8816642
                                                                                                                                                                    SHA1:DC840910DA53DE4B36E53799BB28E7F1E1820498
                                                                                                                                                                    SHA-256:8D4D9113611B17E550FB0CD610BB8A04F5DA437F5A10331E5255E9668844280E
                                                                                                                                                                    SHA-512:10BC2FDACB07EB6927DF412840C30C03D072929109A143009B11A2E8444B92C170AB3853EFC1A8B202504B993100D3C5A6864177F400E8253E4114A49C48361E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF39cce.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24691
                                                                                                                                                                    Entropy (8bit):5.5681674440619995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Ocon83WP03fg/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc9OgzrwlpktuC:Ocon83WP03fg/u1ja1AgIYt5
                                                                                                                                                                    MD5:768A10806A525E155D7D894DD8816642
                                                                                                                                                                    SHA1:DC840910DA53DE4B36E53799BB28E7F1E1820498
                                                                                                                                                                    SHA-256:8D4D9113611B17E550FB0CD610BB8A04F5DA437F5A10331E5255E9668844280E
                                                                                                                                                                    SHA-512:10BC2FDACB07EB6927DF412840C30C03D072929109A143009B11A2E8444B92C170AB3853EFC1A8B202504B993100D3C5A6864177F400E8253E4114A49C48361E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13352240384805449","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13352240384805449","location":5,"ma

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3294
                                                                                                                                                                    Entropy (8bit):6.443902404242879
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:F1mKgm3VN6W/+95KVW6DnnxzgVN6W/+95KOVNo/+95K2VN9/+95KZVNt/+95Ku:F13D/+7K1nV+/+7KL/+7Ku/+7KL/+7Ku
                                                                                                                                                                    MD5:D76D7A13FC9E6F3D59033184F40344BC
                                                                                                                                                                    SHA1:84D82B4F7D5D8EC9C3712F0F7ED2DB5CACA7C8F7
                                                                                                                                                                    SHA-256:4BD8FFBC4E70E87775C49835865BD4761541AE48E4473DB06C3E2BBD2C16B69B
                                                                                                                                                                    SHA-512:C07A4DBEE3D8ACB378A4C5DDAB8F673491A336C26159090C1199DE8F27D9C7756E1E57EDF83EE262628A581EFB6A1BA0C16F162C83CD3E926CE27736B57C0517
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2"..x2................URES:1...INITDATA_NEXT_RESOURCE_ID.2.y...................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1./INITDATA_UNIQUE_ORIGIN:https://www.youtube.com/...REG:https://www.youtube.com/.0......https://www.youtube.com/..https://www.youtube.com/sw.js .(.0.8......@...Z...... WebViewXRequestedWithDeprecation...AvC9UlR6RDk2crliDsFl66RWLnTbHrDbp+DiY6AYz/PNQ4G4tdUTjrHYr2sghbkhGQAVxb7jaPTHpEVBz0uzQwkAAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTcxOTUzMjc5OSwiaXNTdWJkb21haW4iOnRydWV9b.....trueh..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h..h."p.x.................................REGID_TO_ORIGIN:0.https://www.youtube.com/..RES:0.1.....vhttps://www.youtube.com/s/desktop/a4aa4e18/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.js...."@915514BEA40ABFDB462AD92B9CA3EDF5B7B371

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.2743974703476995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:1sjgWIV//Uv:1qIFUv
                                                                                                                                                                    MD5:46295CAC801E5D4857D09837238A6394
                                                                                                                                                                    SHA1:44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
                                                                                                                                                                    SHA-256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
                                                                                                                                                                    SHA-512:8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):299
                                                                                                                                                                    Entropy (8bit):5.183615077179839
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:o+DttRM1CHhJ23oH+TcwtE/a252KLle+UWMq2PCHhJ23oH+TcwtE/a2ZIFUv:oChAYeb8xLgsMvBYeb8J2FUv
                                                                                                                                                                    MD5:CDF72364254EDE103BAD7AA1C8BA48A0
                                                                                                                                                                    SHA1:5A4881D219C7C7EFF417D15C28E287577FC058CA
                                                                                                                                                                    SHA-256:F7E43FFC518BBB18AB9FE9B1ED8BA4B39899AF18F5CD355FBD79B9A402595354
                                                                                                                                                                    SHA-512:9911AEA722A176506FEB09EFB71C71918FA1F19F8113124A331AB0A471C8C237785FE9B5466CCE6466EF36D4D238E2760D4199299E22339B7FD8FEA435ABAC02
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:53.653 26e4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/02/12-20:39:53.724 26e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:OpenPGP Secret Key
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):41
                                                                                                                                                                    Entropy (8bit):4.704993772857998
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:scoBAIxQRDKIVjn:scoBY7jn
                                                                                                                                                                    MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
                                                                                                                                                                    SHA1:D5B5BBF396DC291274584EF71F444F420B6056F1
                                                                                                                                                                    SHA-256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
                                                                                                                                                                    SHA-512:DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.|.."....leveldb.BytewiseComparator......

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):16160
                                                                                                                                                                    Entropy (8bit):6.301719128901452
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:RGUcHOqEcbuCp3bkQspksxlOJ/JES2H2jL/vk5bULVHu+JEY7q:RGNH+AILpksd8jL/IULsgO
                                                                                                                                                                    MD5:3C2C048473FD95F7BBA8F02E36F2BBF8
                                                                                                                                                                    SHA1:E08BDC0550F38168E068A5BEBD4921E04DB4D014
                                                                                                                                                                    SHA-256:728D02416B6FCD5882B8F5F7EF7B027B2C0554C685D47E149DE670314EC30054
                                                                                                                                                                    SHA-512:461F7F79FC9BD409309C2FF3C205B1ACB672227B119C264EACA86E8B524018B742DB01163C04A7D5221DBAEAB402C58E81DD261513B5BDC59CA8A5640EA2D494
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:0\r..m..........rSG.....0/** 2589134419738892857 */self.document = self; self.window = self;var ytcfg={d:function(){return window.yt&&yt.config_||ytcfg.data_||(ytcfg.data_={})},get:function(k,o){return k in ytcfg.d()?ytcfg.d()[k]:o},set:function(){var a=arguments;if(a.length>1)ytcfg.d()[a[0]]=a[1];else{var k;for(k in a[0])ytcfg.d()[k]=a[0][k]}}};.ytcfg.set({"EXPERIMENT_FLAGS":{"H5_enable_full_pacf_logging":true,"H5_use_async_logging":true,"ab_det_apb_b":true,"ab_det_el_h":true,"ab_det_fet_wr":true,"ab_det_fet_wr_en":true,"ab_det_gen_re":true,"ab_sa_ef":true,"action_companion_center_align_description":true,"allow_skip_networkless":true,"att_web_record_metrics":true,"clear_user_partitioned_ls":true,"compress_gel":true,"csi_config_handling_infra":true,"deprecate_csi_has_info":true,"disable_child_node_auto_formatted_strings":true,"disable_pacf_logging_for_memory_limited_tv":true,"disable_simple_mixed_direction_formatted_strings":true,"disable_thumbnail_preloading":true,"embeds_transport_us

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10537
                                                                                                                                                                    Entropy (8bit):5.812391471255035
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:snBzNjXqn3Rn3RsrFdc4DJ1AjI2wURB4EuR19l41Pq2Hbo5OkSISt6SgCnd+Y:s7rqnFRyFdc4DuhT4EuR198P3Hbo5Ok0
                                                                                                                                                                    MD5:85CEB3EE9D831BB298C1B17AA007016F
                                                                                                                                                                    SHA1:64638F2655012217AB47C6824FEFE226BE22E91F
                                                                                                                                                                    SHA-256:675D8E03C6DD71C96F067EA09DAA81F6058180F6C6FE5B10B7AE0E33088F3CE5
                                                                                                                                                                    SHA-512:31BC121B21FFE2D54E1E777AB2C51DFA4F37242F6AC3102B82FD40E04E2017EB53F6718EFB10E7538535221DCE888B174857DDAC1FCB72BEDE8B6BB498FCE3D4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:0\r..m..........rSG.....0....z3.................;{....x..(.......,T....`.....hL`0.....L`......Rc........ytcfg.....Rc*im.....policy...............$..a............C...C...C.,T.L.`V.....L`..........Rb.^......yt....Rc6:.Y....config_.....Rc..t.....data_......Dm............!...-.....!...-.....!...-.....!...~.2........$Sb................`....Da............d..........`...P......H......,Q.(F.......https://www.youtube.com/sw.js...a........Db............D`.......A.`............,T.L..`T.....L`..........Dm............!...-....]...r....!...-....]....../..........$Sb...............`....DaH..........c..........@......<e..........................,T...`......L`................D~X..............-......n... !...-....]...../...../..4....A./...;v............-........!...-....]...../...../..4.....,.......$Sb...............`....Da......... ..f.........D......`.... ...\...e..........................,T.$.`......L`......R..b..Fv...https://www.youtube.com/s/desktop/a4aa4e18/jsbin/serviceworker-kevlar-appshell.v

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):164697
                                                                                                                                                                    Entropy (8bit):5.6301046947668345
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:QvX5Lw5UCDJVZHL08oy6CiEETgDAGXoI7xuSrnCvn9nEBFqx0vI+FCTA0bIF:QvX5LKUCDJVZHL08oyRiJsD7oIS9+FRp
                                                                                                                                                                    MD5:A7DFFA4C0280BFF7B962C4DA59C63870
                                                                                                                                                                    SHA1:A3A7A81C2CD238991A9E60E6BCAD9D8311A80202
                                                                                                                                                                    SHA-256:CA027ABFA783ED834688036E8EF27EDC91BF93C9DAD914AAA01050F8E1A764FF
                                                                                                                                                                    SHA-512:64C406C01C2D7923F2E68578E9228AC100129FF6ED9149841ADD237CCB858DBDD0784FAFDA20AC28D6E5087116FA1E52B22213714D4966691087809DC178AB77
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:0\r..m..........V.......1'use strict';var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ca=ba(this);function da(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}}.function ea(a){function b(d){return a.next(d)}.function c(d){return a.throw(d)}.return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}.f(a.next())})}.function r(a){return ea(a())}.function fa(a,b){a instanceof String&&(a+="");var c=0,d=!1,e={next:funct

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_1

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):398105
                                                                                                                                                                    Entropy (8bit):6.108347087518806
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:5tFuZwvUOK5ZlEyityphfU07NC/gV2XmB3V5mkwcj:5tcZwvUO8OtypE4YXAVwkL
                                                                                                                                                                    MD5:C45C1FF4478347D656A90C97AEA4A916
                                                                                                                                                                    SHA1:CE824B4DD5AB7D86A246B02F425477FB365785BE
                                                                                                                                                                    SHA-256:6D4A8177142BEF98DD7A3C128DDD18D1E481E2D49F4656292A85E13EC834942B
                                                                                                                                                                    SHA-512:820F35D39B5EB3A61EA9C11BA6201653E84B65E6860DE6A8D9EBA40DE3589EC6AA281E8FD0BA61BA66D3F439AD4ED5031AFBF208A498D4ED8C69BCA4B44895C9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:0\r..m..........V.......1....z3.................;$....x..........,T..1..`.a.....L`P......L`......RbV.3v....aa...,T...`.....,L`.......}.`......Le...........................................r......(Rh......Cannot find global object......D.. ...........z..%...".. ...!..6........6......".. ...!..6......".. ...!..6......".. ...!..6........-...m...#../....-....!..k.........P..&..!......b..!..(Sb.............RbJVl.....ba..`....Dax...n....1.Sb.`...............c..................Rb.7A.....oo..`......Rb.(.m....wk..`......Rb.@......gb..`.....D..Rb.......wi..`......Rb.|......El..`.....D..Rb........Ja..`.....D..Rb&.Z.....bb..`.....D..RbF`......ui..`......RbJ......Lc..`,....D..RbRP&.....vi..`......RbV.......Sb..`......RbZ..\....qe..`P....D..Rbb.s....Vf..`b.....Rbf.s.....Rc..`4.....Rbj. .....Ak..`......RbV.......Oj..`......Rbr.}.....Kj..`......Rbj.-|....Hl..`......Rbb.x.....en..`.....D..Rb.,......Bb..`.....D..Rb..XM....xo..`.....D..Rb........Ya..`......Rb.......Nb..`......Rb...y....Nf..`^...

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24
                                                                                                                                                                    Entropy (8bit):2.1431558784658327
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:m+l:m
                                                                                                                                                                    MD5:54CB446F628B2EA4A5BCE5769910512E
                                                                                                                                                                    SHA1:C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
                                                                                                                                                                    SHA-256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
                                                                                                                                                                    SHA-512:8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:0\r..m..................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):96
                                                                                                                                                                    Entropy (8bit):3.5732876844540202
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:y3NT0Qyq/Gljf/mQf6v5D:y3xXQ/mQfwD
                                                                                                                                                                    MD5:5895FF5ABB27D0DE3531379F285B7569
                                                                                                                                                                    SHA1:DC74932049C28004B5D0E129A4340425BB680C17
                                                                                                                                                                    SHA-256:928ED837833908D231AB233AD9131E29CD34D8D71EDC62FE3609679111CFF5A8
                                                                                                                                                                    SHA-512:957B872F32FC81DF2D4444CDE351C3AFC2C10EEB3140CD11B622D40BDC2C921EC839A47CADF775550706EDC87DA68F4C61ACA2F49A716043BAAB3F9DEDC2389C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:X......qoy retne........................5j.+y..L.................X....,t........i......!0..o/.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):96
                                                                                                                                                                    Entropy (8bit):3.5732876844540202
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:y3NT0Qyq/Gljf/mQf6v5D:y3xXQ/mQfwD
                                                                                                                                                                    MD5:5895FF5ABB27D0DE3531379F285B7569
                                                                                                                                                                    SHA1:DC74932049C28004B5D0E129A4340425BB680C17
                                                                                                                                                                    SHA-256:928ED837833908D231AB233AD9131E29CD34D8D71EDC62FE3609679111CFF5A8
                                                                                                                                                                    SHA-512:957B872F32FC81DF2D4444CDE351C3AFC2C10EEB3140CD11B622D40BDC2C921EC839A47CADF775550706EDC87DA68F4C61ACA2F49A716043BAAB3F9DEDC2389C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:X......qoy retne........................5j.+y..L.................X....,t........i......!0..o/.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF3224e.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):96
                                                                                                                                                                    Entropy (8bit):3.5732876844540202
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:y3NT0Qyq/Gljf/mQf6v5D:y3xXQ/mQfwD
                                                                                                                                                                    MD5:5895FF5ABB27D0DE3531379F285B7569
                                                                                                                                                                    SHA1:DC74932049C28004B5D0E129A4340425BB680C17
                                                                                                                                                                    SHA-256:928ED837833908D231AB233AD9131E29CD34D8D71EDC62FE3609679111CFF5A8
                                                                                                                                                                    SHA-512:957B872F32FC81DF2D4444CDE351C3AFC2C10EEB3140CD11B622D40BDC2C921EC839A47CADF775550706EDC87DA68F4C61ACA2F49A716043BAAB3F9DEDC2389C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:X......qoy retne........................5j.+y..L.................X....,t........i......!0..o/.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3472
                                                                                                                                                                    Entropy (8bit):4.823973983641992
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:tZZZZ5lwIUBhtUvjX9mJS+vjWvHDWHFw3TQqDX6l5RM5zjEMTNpj8W4+63VqsORk:lwIU5UvjX9mrbWvHKHFqnSAVTLjl4Eg
                                                                                                                                                                    MD5:F3B07936729A8D9CFCE3E65555942D5B
                                                                                                                                                                    SHA1:2786505E841A2FA788B7090607672991BA3A4FA8
                                                                                                                                                                    SHA-256:3C09C1C3A928A30EF22D58DADE1135DB33786BCFBA434E5453A40785196A4908
                                                                                                                                                                    SHA-512:A5108CD47C46CADE4955976631A54C78CB9D816287A8EAE95257E049BB4C2116B6308E373C9E986EEC5A68BF3C8A22C5467F373DEF46A3971846ADE9F3C584CE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................._.f................next-map-id.1.Gnamespace-6c87ddb3_9d9e_479f_9142_e5c15a0473e5-https://www.youtube.com/.0../.j................next-map-id.2.Knamespace-6c87ddb3_9d9e_479f_9142_e5c15a0473e5-https://accounts.google.com/.1.9ON.................map-0-__sakf...f................next-map-id.3.Gnamespace-3d867ab2_5b41_4224_b56b_951dbbb0a816-https://www.youtube.com/.2...g................next-map-id.4.Hnamespace-42bd7ff5_7509_428b_b43c_28604ede695f-https://www.facebook.com/.3.-!.j................next-map-id.5.Knamespace-b28a3a72_8b6d_4b4c_81de_2d7cdea9dbf7-https://accounts.google.com/.4w6$................w6$.................Y8..................map-2-__sak.1.T.Do...............T.Do................Y.k................next-map-id.6.Lnamespace-b28a3a72_8b6d_4b4c_81de_2d7cdea9dbf7-https://accounts.youtube.com/.5NX.C................map-3-TabId.a.4.9.i.9.3...map-3

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.15756070880955
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oe1Vq2PCHhJ23oH+TcwtrQMxIFUt8deUjUgZmw+de0OIkwOCHhJ23oH+TcwtrQMT:oe1VvBYebCFUt8deUjUg/+dexI56Yebf
                                                                                                                                                                    MD5:422EA0A905F939B4E38875510161D8A0
                                                                                                                                                                    SHA1:5EAABA9BF94EC9ACFF7E0D7FDFD6F634816BF040
                                                                                                                                                                    SHA-256:B26932D250812255C1E56858BAFF7E9C601174B7EF72E0F17177CB8874AEA981
                                                                                                                                                                    SHA-512:6524E4572D77F34BDA82F86C875AF4127E3A7699108FE17739E44D4D4F0F2BFA68E5416152497E5DBE465CCF3D03F6D89C9B16397314EFEA0807A43A8C8BC4A7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.792 2804 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/02/12-20:39:45.824 2804 Recovering log #3.2024/02/12-20:39:46.290 2804 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.15756070880955
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oe1Vq2PCHhJ23oH+TcwtrQMxIFUt8deUjUgZmw+de0OIkwOCHhJ23oH+TcwtrQMT:oe1VvBYebCFUt8deUjUg/+dexI56Yebf
                                                                                                                                                                    MD5:422EA0A905F939B4E38875510161D8A0
                                                                                                                                                                    SHA1:5EAABA9BF94EC9ACFF7E0D7FDFD6F634816BF040
                                                                                                                                                                    SHA-256:B26932D250812255C1E56858BAFF7E9C601174B7EF72E0F17177CB8874AEA981
                                                                                                                                                                    SHA-512:6524E4572D77F34BDA82F86C875AF4127E3A7699108FE17739E44D4D4F0F2BFA68E5416152497E5DBE465CCF3D03F6D89C9B16397314EFEA0807A43A8C8BC4A7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.792 2804 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/02/12-20:39:45.824 2804 Recovering log #3.2024/02/12-20:39:46.290 2804 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13352240387297000

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):68494
                                                                                                                                                                    Entropy (8bit):3.5110660868722805
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:To/fuCCAxXjNQLn6ffFtbtjHWwVCzhOLkeV40hL+obweHEf2KEeghhj2kb2Kpb12:TgGhqNonmHkzgV4hobjHGYeXnQL
                                                                                                                                                                    MD5:85612C935B0A9232E4E515644C2DC421
                                                                                                                                                                    SHA1:051FB9E809C2DC214D200BDB3608F49D60F774CE
                                                                                                                                                                    SHA-256:8B8091E40C25371091D3E957F458903DDB4BA4B2ABDE288F859651D78C27FCEF
                                                                                                                                                                    SHA-512:FC63BD5B69FDF2763A433DE3EACC755DCC27CF461AB354ED1B99E0E28A591161DDBFD4486492700DAAD6C26801085AE1F1DDDF256D15508D752B29BC24057EC9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SNSS........_'............_'......"._'............_'........_'........_'........_'....!..._'................................_'._'1..,...._'$...6c87ddb3_9d9e_479f_9142_e5c15a0473e5...._'........_'......i........._'...._'........................_'....................5..0...._'&...{890D5FC3-0C4C-4214-A93A-B8E730A022A1}......_'..........._'............_'........https://www.youtube.com/....d...`...!...X...................................................................................................-[.p4....[.p4...................................h...............................................8.......h.t.t.p.s.:././.w.w.w...y.o.u.t.u.b.e...c.o.m./.................................8.......0.......8....................................................................... .......................................................P...$...3.7.0.6.5.6.e.8.-.a.3.f.8.-.4.8.a.1.-.a.3.0.9.-.b.7.6.7.4.a.c.7.0.9.d.a.................P...$...f.3.b.e.d.9.d.c.-.f.0.0.e.-.4.6.e.e.-.b.3.3.e.-.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):0.44194574462308833
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
                                                                                                                                                                    MD5:B35F740AA7FFEA282E525838EABFE0A6
                                                                                                                                                                    SHA1:A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
                                                                                                                                                                    SHA-256:5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
                                                                                                                                                                    SHA-512:05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):352
                                                                                                                                                                    Entropy (8bit):5.141312726851656
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeeBq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8deOWZmw+deMtkwOCHhJ23oH+Tcwt7Uh9:oeeBvBYebIhHh2FUt8deOW/+deE56YeQ
                                                                                                                                                                    MD5:8EDCBB0AB837C655394649AE20A026FE
                                                                                                                                                                    SHA1:6786D08D07E44CF313C0A47E0FEB61A3F4ED363F
                                                                                                                                                                    SHA-256:807C153A99E63B6A0869B5B62A45FEE657B17695F09BFE5DE30B4B892AD31708
                                                                                                                                                                    SHA-512:53E99DD24592E84BE4CC1E97794BFEDCDDCBC6568E5FD320F966C47F9D36F45E5A226459E113C5406D6350D453735D80A6E50F8A47CCBEB9C38E38A61C1EAAAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.797 26e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/02/12-20:39:44.809 26e4 Recovering log #3.2024/02/12-20:39:44.811 26e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):352
                                                                                                                                                                    Entropy (8bit):5.141312726851656
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeeBq2PCHhJ23oH+Tcwt7Uh2ghZIFUt8deOWZmw+deMtkwOCHhJ23oH+Tcwt7Uh9:oeeBvBYebIhHh2FUt8deOW/+deE56YeQ
                                                                                                                                                                    MD5:8EDCBB0AB837C655394649AE20A026FE
                                                                                                                                                                    SHA1:6786D08D07E44CF313C0A47E0FEB61A3F4ED363F
                                                                                                                                                                    SHA-256:807C153A99E63B6A0869B5B62A45FEE657B17695F09BFE5DE30B4B892AD31708
                                                                                                                                                                    SHA-512:53E99DD24592E84BE4CC1E97794BFEDCDDCBC6568E5FD320F966C47F9D36F45E5A226459E113C5406D6350D453735D80A6E50F8A47CCBEB9C38E38A61C1EAAAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.797 26e4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/02/12-20:39:44.809 26e4 Recovering log #3.2024/02/12-20:39:44.811 26e4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                    Entropy (8bit):0.001802026882503809
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2zEkloR1:/M/xT02znO
                                                                                                                                                                    MD5:81136583EFB4E1A8EF52AB507674B95F
                                                                                                                                                                    SHA1:3B6B698B037980084D829808935E4F7E8098C544
                                                                                                                                                                    SHA-256:EB0AEACDF063D7C69926EA954640431544EE45D05036E32B3DDEAB72724BE0FA
                                                                                                                                                                    SHA-512:89F15C6C794ED671081993095B56F42B6B32EC8C12F1FBB567A949345062F33700BD1F5E4E068C26F16E6057B9E58746FC7265A1E99FA9F8509E5791AD6916D5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):270336
                                                                                                                                                                    Entropy (8bit):0.001802026882503809
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:MsEllllkEthXllkl2zEklaY51:/M/xT02znaM
                                                                                                                                                                    MD5:148FBA1F94E42D04F00E09FA8EB37A70
                                                                                                                                                                    SHA1:1BDC0CCA49AAAAAC6E572213BC5DFFD2CECD397F
                                                                                                                                                                    SHA-256:32994ED735BF0DE1F1E9A5EAD28695356F7ACC9580C7036BC2B6B89E6D3392C3
                                                                                                                                                                    SHA-512:8A1E4063D8AC5A1224F0584BF9F66A2455A6319CDDC9C8CEDA7F0611813FABF2F2067B542135EEB366F987F9E6341CE3BDE451B0CDA3FA2865079D872595159E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):434
                                                                                                                                                                    Entropy (8bit):5.237353631701319
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:oeeAVvBYebvqBQFUt8deQAg/+de6AI56YebvqBvJ:orKBYebvZg8dB6rV6Yebvk
                                                                                                                                                                    MD5:1A2A805C62316E7EE56B7EAECCF27A89
                                                                                                                                                                    SHA1:05C84D0996AFC0D86042E37B668FE13E7E661165
                                                                                                                                                                    SHA-256:D3859FCD705894459AFFA307ACCE501215A648C82B80DF8EAAB2FF690DF24BFF
                                                                                                                                                                    SHA-512:E06DC3A268ACCD4FC08C07F2A7F49C2D4F89BEE6A0701E1891C0A066AF8BB6567E380C31CB6876CA15A634D54C0E958EFED901266EAB98A9A29C3B1E447671B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:46.066 2830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/02/12-20:39:46.077 2830 Recovering log #3.2024/02/12-20:39:46.084 2830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):434
                                                                                                                                                                    Entropy (8bit):5.237353631701319
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:oeeAVvBYebvqBQFUt8deQAg/+de6AI56YebvqBvJ:orKBYebvZg8dB6rV6Yebvk
                                                                                                                                                                    MD5:1A2A805C62316E7EE56B7EAECCF27A89
                                                                                                                                                                    SHA1:05C84D0996AFC0D86042E37B668FE13E7E661165
                                                                                                                                                                    SHA-256:D3859FCD705894459AFFA307ACCE501215A648C82B80DF8EAAB2FF690DF24BFF
                                                                                                                                                                    SHA-512:E06DC3A268ACCD4FC08C07F2A7F49C2D4F89BEE6A0701E1891C0A066AF8BB6567E380C31CB6876CA15A634D54C0E958EFED901266EAB98A9A29C3B1E447671B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:46.066 2830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/02/12-20:39:46.077 2830 Recovering log #3.2024/02/12-20:39:46.084 2830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[]

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):36864
                                                                                                                                                                    Entropy (8bit):0.3886039372934488
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
                                                                                                                                                                    MD5:DEA619BA33775B1BAEEC7B32110CB3BD
                                                                                                                                                                    SHA1:949B8246021D004B2E772742D34B2FC8863E1AAA
                                                                                                                                                                    SHA-256:3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
                                                                                                                                                                    SHA-512:7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ae1c0f0f-a102-4b83-8716-30a89d5468cd.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2
                                                                                                                                                                    Entropy (8bit):1.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:H:H
                                                                                                                                                                    MD5:D751713988987E9331980363E24189CE
                                                                                                                                                                    SHA1:97D170E1550EEE4AFC0AF065B78CDA302A97674C
                                                                                                                                                                    SHA-256:4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
                                                                                                                                                                    SHA-512:B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[]

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e79258fa-7f0f-491f-a621-8aaeb2889c11.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40
                                                                                                                                                                    Entropy (8bit):4.1275671571169275
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:Y2ktGMxkAXWMSN:Y2xFMSN
                                                                                                                                                                    MD5:20D4B8FA017A12A108C87F540836E250
                                                                                                                                                                    SHA1:1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
                                                                                                                                                                    SHA-256:6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
                                                                                                                                                                    SHA-512:507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"SDCH":{"dictionaries":{},"version":2}}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):80
                                                                                                                                                                    Entropy (8bit):3.4921535629071894
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
                                                                                                                                                                    MD5:69449520FD9C139C534E2970342C6BD8
                                                                                                                                                                    SHA1:230FE369A09DEF748F8CC23AD70FD19ED8D1B885
                                                                                                                                                                    SHA-256:3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
                                                                                                                                                                    SHA-512:EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:*...#................version.1..namespace-..&f.................&f...............

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):422
                                                                                                                                                                    Entropy (8bit):5.178929928372058
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:HOVvBYebvqBZFUt8iSg/+3I56YebvqBaJ:HQBYebvyg8ir6YebvL
                                                                                                                                                                    MD5:0360410E2B7F47A87882914FFDFCA434
                                                                                                                                                                    SHA1:2E14D92797AF0C6F3F47185111FC92CB7364AC8B
                                                                                                                                                                    SHA-256:7DAAC7B5F2509309ED017E75D4FCE11FEF9601BD83AEA7912DB01FF45AFB24AF
                                                                                                                                                                    SHA-512:6790C2784964C375C9C9703A4F9D383AD1C6C6FD295A4D2ADCE37ADBBE9002A6CB31F51D4E81128B2A962DA3380E21F711468AA55673FA42308E9FEC4D14E0BA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:26.181 2804 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/02/12-20:40:26.183 2804 Recovering log #3.2024/02/12-20:40:26.202 2804 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):422
                                                                                                                                                                    Entropy (8bit):5.178929928372058
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:HOVvBYebvqBZFUt8iSg/+3I56YebvqBaJ:HQBYebvyg8ir6YebvL
                                                                                                                                                                    MD5:0360410E2B7F47A87882914FFDFCA434
                                                                                                                                                                    SHA1:2E14D92797AF0C6F3F47185111FC92CB7364AC8B
                                                                                                                                                                    SHA-256:7DAAC7B5F2509309ED017E75D4FCE11FEF9601BD83AEA7912DB01FF45AFB24AF
                                                                                                                                                                    SHA-512:6790C2784964C375C9C9703A4F9D383AD1C6C6FD295A4D2ADCE37ADBBE9002A6CB31F51D4E81128B2A962DA3380E21F711468AA55673FA42308E9FEC4D14E0BA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:40:26.181 2804 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/02/12-20:40:26.183 2804 Recovering log #3.2024/02/12-20:40:26.202 2804 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):328
                                                                                                                                                                    Entropy (8bit):5.209665099506109
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeGEVFIq2PCHhJ23oH+TcwtpIFUt8deM4Zmw+des8FzkwOCHhJ23oH+Tcwta/WLJ:oeG8OvBYebmFUt8de//+deZF56YebaUJ
                                                                                                                                                                    MD5:1A07DDD3A67E62D9972520CCEA2683DC
                                                                                                                                                                    SHA1:376172D5F71597107E48EAFBE54E1718AAD649C5
                                                                                                                                                                    SHA-256:10B763704A24AF1C9BE006117FB05D2B758F9978BC530A6A05850777B6739F19
                                                                                                                                                                    SHA-512:5CCE3F042A59D47389AF9AD8D6FED6BB92B65B7A92A616AB8EE42DFDED565B9B3C8B38959B873BB270EA24EB0D1BC45FE7D613B7CB2038864EA909DC7C7DBB17
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.801 27d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/02/12-20:39:44.812 27d0 Recovering log #3.2024/02/12-20:39:44.821 27d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):328
                                                                                                                                                                    Entropy (8bit):5.209665099506109
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeGEVFIq2PCHhJ23oH+TcwtpIFUt8deM4Zmw+des8FzkwOCHhJ23oH+Tcwta/WLJ:oeG8OvBYebmFUt8de//+deZF56YebaUJ
                                                                                                                                                                    MD5:1A07DDD3A67E62D9972520CCEA2683DC
                                                                                                                                                                    SHA1:376172D5F71597107E48EAFBE54E1718AAD649C5
                                                                                                                                                                    SHA-256:10B763704A24AF1C9BE006117FB05D2B758F9978BC530A6A05850777B6739F19
                                                                                                                                                                    SHA-512:5CCE3F042A59D47389AF9AD8D6FED6BB92B65B7A92A616AB8EE42DFDED565B9B3C8B38959B873BB270EA24EB0D1BC45FE7D613B7CB2038864EA909DC7C7DBB17
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:44.801 27d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/02/12-20:39:44.812 27d0 Recovering log #3.2024/02/12-20:39:44.821 27d0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):131072
                                                                                                                                                                    Entropy (8bit):0.011021617786818889
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:ImtVdue/l//uOUl/lqA/tOvlt+Ot/qtgFJlXjxqlll:IiVsGvUltqA/t2n2gzlXjxq/
                                                                                                                                                                    MD5:7EC1C4948204786B7106411F4CBC792B
                                                                                                                                                                    SHA1:480EC3BDB669B7180584B0766FF860B5A5DAB998
                                                                                                                                                                    SHA-256:878764DC448827FD45C023BDD75DFD0B05C54D5707333D46A4E3E12A59AA1121
                                                                                                                                                                    SHA-512:39B5B498C20B42C0014B89B9CA9BC74EBFA6FCC927CBDCF59B0F9757AD0D0482DF2929ED0C751162EA5CC1CCA69FAE625B884F5C6C0D1146D90AEE1356169F57
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:VLnk.....?.........S{...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 92, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.2789106066096034
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:Z/2qOB1nxCkcSAELyKOMq+8QTQKC+CVumPy:4q+n0f9ELyKOMq+8Q74y
                                                                                                                                                                    MD5:3220F533A6575837C9A1C6508C9E3FA7
                                                                                                                                                                    SHA1:113F71692EC08B115E60672B4CE084309E4F10BF
                                                                                                                                                                    SHA-256:EFEE4F4CB9D75D15CFF9C6AE3E5BF0A845DB94A7E0AD442E70F57F683FCD1382
                                                                                                                                                                    SHA-512:76671824B2588A1B27A910456139BD7FEEFD5410EAF922CC1C86A6580BFDE325D9A585BBE96146B16A61D8B73E0701ABCFE0DE9BDECD3B3F86B5A8AEFA3BE47C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......\...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                    Entropy (8bit):0.4712444047494954
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBg3iFbT:v7doKsKuKZKlZNmu46yjxg3iFv
                                                                                                                                                                    MD5:0C4E4696B20463ECB5FA5630584C1DAC
                                                                                                                                                                    SHA1:36A6274002AEA02DE349151059EB425EAB6668CA
                                                                                                                                                                    SHA-256:1372960FBE0EC41D9922ED1BD7D522DE1986ADBC944B012A8D4DED524102E945
                                                                                                                                                                    SHA-512:99DB8CD9011A9F8217FFA236D4309B8B4798AFA9F6D0556D9CF97F1BB7619BCBF935ABBE2C7B41F822BFF24F736214B2A0C0A4506BA9E88C8C1F1AE6321C4C81
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):12824
                                                                                                                                                                    Entropy (8bit):0.14550630786412713
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:eNllHXtXlPeW+hg/r/DSLUxGTKSS4UxGTkQftK5nGleP/etXlz1M7:alPek2LUxGFdUxGvG2eclzK
                                                                                                                                                                    MD5:2A86A21728089A8543D2CEE5C519C304
                                                                                                                                                                    SHA1:6DC7F837554FECEF66DAEE81B03FFBB337D2B4CE
                                                                                                                                                                    SHA-256:3CBD8FB860D8CC2725CDF8D0F9AF28DB5527CE69E123DFB8735B5F3876F38772
                                                                                                                                                                    SHA-512:8F29B3E15D722C568F01CBF8555671C433FA46C3074D9A13608C8A4AAFC3DE611347A1446A731F5A6812B240132A8834410DEAB2B17B8CAB2A9DEC4E33B66700
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:............x...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a01ef94b-cf3d-45f5-95d0-8336ca5d28ff.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9631
                                                                                                                                                                    Entropy (8bit):5.1088714761237215
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkV3J83bV+FPeQE4Qtq7NIjPUYJ:st9bsQOXebGWQF17NIp
                                                                                                                                                                    MD5:50387E1CDF822A9888FCD9BB9CE12FE4
                                                                                                                                                                    SHA1:12E46E0F2B174A8776C11008242916EF8AD1D46D
                                                                                                                                                                    SHA-256:D05167135667B1049D69DB61F58768DCC33EA1FB13E25F68EB6107459A3F6394
                                                                                                                                                                    SHA-512:57DDF19743ADE1CC4CB799B80FFF10503055C26ACB47899A5AACF1E81C8AD18EC7277DCEBF3D73550F201AF9F061E1E879F8F09501D7EA955281AA7F356861EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (3951), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):11755
                                                                                                                                                                    Entropy (8bit):5.190465908239046
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
                                                                                                                                                                    MD5:07301A857C41B5854E6F84CA00B81EA0
                                                                                                                                                                    SHA1:7441FC1018508FF4F3DBAA139A21634C08ED979C
                                                                                                                                                                    SHA-256:2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
                                                                                                                                                                    SHA-512:00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\blob_storage\df62c6c4-5c47-46e2-be0b-0a83ac0af9c5\0

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (2825)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3213908
                                                                                                                                                                    Entropy (8bit):5.588389769165317
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:E6rnenMR2YyHgMo08ipEbHna27UEaH+MfGLeuuyQ8XKK09kZC+gcV:E6Jtdj
                                                                                                                                                                    MD5:E4F46C11FCED19A0F17757AE159AF12F
                                                                                                                                                                    SHA1:F9FE746612A007E1949BB822F8EDB2C762FAFEB4
                                                                                                                                                                    SHA-256:38A6488AF56B00BF8EF62B8C6BD387B4A331BFCCF380BFDABB9F61EBD487460A
                                                                                                                                                                    SHA-512:8FF5D7F9B49260AADAFEDCA8F1081845863D41EAEE08C2466F245FF9AED60CADB52BA788C112D423C0FCCC101EA6D33A606E6A99358CC162CD02532B8FD2EB55
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:"disabled","initialized","start","end"),w("design:type",Function),w("design:paramtypes",[Object,Boolean,Boolean,Boolean,Number,Number,Number]),w("design:returntype")],f_.prototype,"updateLoopRange_",null);.v([ZC("start","end","rulerShift_","tickSpacing_","windowSizeSec_"),w("design:type",Function),w("design:paramtypes",[Number,Number,Number,Number,Number]),w("design:returntype")],f_.prototype,"updateHandles_",null);v([ZC("start","end"),w("design:type",Function),w("design:paramtypes",[]),w("design:returntype")],f_.prototype,"updateRuler_",null);.v([ZC("draggingLeft_","draggingRight_","draggingRuler_","draggingWindow_"),w("design:type",Function),w("design:paramtypes",[]),w("design:returntype")],f_.prototype,"onDragStateChanged_",null);f_=v([iD({disableElementRegistration:H("shared_enable_controller_extraction"),is:"yt-clip-creation-scrubber-view",noInjection:!0})],f_);H("shared_enable_controller_extraction")&&V(f_,"yt-clip-creation-scrubber-view",function(){return rrc()});var trc=functio

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\cd9a8d79-7d78-4427-bb27-8acd236ead5a.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):9737
                                                                                                                                                                    Entropy (8bit):5.119170802924533
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34HkR3J83bV+FPeQE4Ltq7NIjPUYJ:st9bsQOXSbGWQFc7NIp
                                                                                                                                                                    MD5:9E3F66921DDB74DC7E4B91DCB0350898
                                                                                                                                                                    SHA1:E262B2886539DE37F2137142E716AEDDE318B8F4
                                                                                                                                                                    SHA-256:2BE41AA252B23D58B2363E160A887A67AC4F8FCE85103A0AB854A2DF94A35307
                                                                                                                                                                    SHA-512:7A6062C92EDD41C29E4F9687330CE80ACFD4F2FE8A954A269BFB70FF21722B9403A6843819D9443ECC67A586354EBCA554A87880DA490186FD66C6CC277C2C5F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d6532afa-fc10-4b83-8117-b2ccc75f97c0.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):14162
                                                                                                                                                                    Entropy (8bit):5.232875351311672
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9J99QTryDigabatSuyosQOIa34HkQ3J8TFbV+FPl9c/n6k9wEvystq7NIjPUhJ:st9PGKSuzsQOXVFbGN9cnxw8yZ7NIe
                                                                                                                                                                    MD5:A2D9F9D459DA915A2DAD8F0BAD1DDA33
                                                                                                                                                                    SHA1:6B17C61DFCB1D1725F1797272FF3CBA1E5B62946
                                                                                                                                                                    SHA-256:C613F07C0B5B83C03AA9B8084EF9339CB1020959A877A8297E56C745047646D1
                                                                                                                                                                    SHA-512:F0BAC2132A0871ADFB2477D6061FE4C28F1A263910BC347E7681BF72EA10A501B760393A5DC4A23055EDE749EE2C4FE7A9EF9E21C7DBBA319565DEE707A7C47C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):28672
                                                                                                                                                                    Entropy (8bit):0.3410017321959524
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
                                                                                                                                                                    MD5:98643AF1CA5C0FE03CE8C687189CE56B
                                                                                                                                                                    SHA1:ECADBA79A364D72354C658FD6EA3D5CF938F686B
                                                                                                                                                                    SHA-256:4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
                                                                                                                                                                    SHA-512:68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\dd498e88-0f3e-47e8-8dce-2118805bdf22.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):11210
                                                                                                                                                                    Entropy (8bit):5.151784975495235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:st9kdosQOIa34Hkb3J8RFbV+FPl9c/n6k9wEv3stq7NIjPUhJ:st9bsQOXMFbGN9cnxw83Z7NIe
                                                                                                                                                                    MD5:2C1AACE8C96A83F1B0CD903E92FDC864
                                                                                                                                                                    SHA1:95A1213B888DA9C1AECF63F87F729E1BE0107FE6
                                                                                                                                                                    SHA-256:1D805F7E267F34F87DCA0724D1395F836029EB671FB2F624E67C921BAAF35BCF
                                                                                                                                                                    SHA-512:AA4B9D1EA3CD6CEE262324CEFD65DF4891B242E3EF31D42A2B9443260659860727D4D1B2C7139B4183680BF9DC372ADBDBAC62A398CA66DEA8685791ED1D12C6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13352240385738601","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340968290017037","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":914,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":70,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"li

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f18357d1-13d4-4457-b24c-cd3ea3311dc7.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:L:L
                                                                                                                                                                    MD5:5058F1AF8388633F609CADB75A75DC9D
                                                                                                                                                                    SHA1:3A52CE780950D4D969792A2559CD519D7EE8C727
                                                                                                                                                                    SHA-256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
                                                                                                                                                                    SHA-512:0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, writer version 2, read version 2, file counter 26, database pages 30, cookie 0x7, schema 4, UTF-8, version-valid-for 26
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):122880
                                                                                                                                                                    Entropy (8bit):4.315276442760502
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:SKZa4OVUkn3mrEywAjEesFjLlNgbgIiB5EXWsZ00Z:Ja4hkn3mrszFNYbgIE5EBKA
                                                                                                                                                                    MD5:456DE99EB9CED977A0641F444F256668
                                                                                                                                                                    SHA1:9174D732C95BA5E42835B90C8950F24CD0CCB0D4
                                                                                                                                                                    SHA-256:8FA3BD965C4C0EDB777807BE33FB315CAADEB0ACAD6494FE5E49C438DD71367D
                                                                                                                                                                    SHA-512:911C735772E62AE29E30196238F57E189C37C6F6244F7028D226DD24B05F56D4F67796CF09E1BB0F5D1C09C2C8690C9EAA62FF7FBAE33B6BFA8E66DF4DAF6583
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..................?.P................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.07565301044533909
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:Gbt62aU8Cht62aU8Cf89Xqlcl/88l/8wl/SRWl8tyliCWlLcl/UluKlHflXJgdmc:L48Cu48CfsqlU/LDxYFWcUKF8tJbl
                                                                                                                                                                    MD5:74C4145F646F5E8B824F3934FFE2FB94
                                                                                                                                                                    SHA1:00AD69470BF743FCBF6CE71B82051617D3842A7B
                                                                                                                                                                    SHA-256:4923649C2F7A2093FEF66C317A6889C4D5069C9808C8EA8A38E9731F5B4E05D5
                                                                                                                                                                    SHA-512:3ABF8B900A3297F9A14B3AD93D76928755CB5F7DAB7E4BAA63BC42EF29E85C5186CE0A38DBD36A4BB177E03A36417B7EACA4062AD85D0A29CE876DC1D31DE920
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.............-.......!.A.sT...XE8&/^......I...-.............-.......!.A.sT...XE8&/^......I.........(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4124152
                                                                                                                                                                    Entropy (8bit):5.658567974197139
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:q+jOs+QOqSrwiAcO9QWzSeMuITv1/WcBYBPvMh1VHibmOWuKlLHZgkc+k:fOsx1
                                                                                                                                                                    MD5:37FF48BBD0235B8586CFE94339A18395
                                                                                                                                                                    SHA1:8121F6FF2DB86F87ED68FADB97F46A844F03C474
                                                                                                                                                                    SHA-256:ABD1F2BDC7E46D51D1033FB75D23847450682BDD245DB6A2E9BA9435C811E70B
                                                                                                                                                                    SHA-512:13E675AB5F111C5833C42BAD0B9F3FF7EA3B8E02B53B72BBF3F7FF4A53C79E2B142F3933580314E8969EEFF547B50587F9587527BE81C85E573BADC50EE5ECDA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:7....-...........XE8&/^..,\.]rb..........XE8&/^...\.0.n.....?.m........y.D.......p.;.......g.2...........a.,......._.1.........U.).......y.M.!.......q.E.........i.=.........e.?.m.........x.M. .........b.<.........~.X.2.........z.V.1.........x.S....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.21292172994544
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeEF34q2PCHhJ23oH+TcwtfrK+IFUt8de89JZmw+de73DkwOCHhJ23oH+TcwtfrF:oeEFIvBYeb23FUt8de8H/+den56Yeb3J
                                                                                                                                                                    MD5:DA35433A7F01C811EFB4829CE7B16BB2
                                                                                                                                                                    SHA1:7420EE59FFAC8B90E43C6B05D6E50B53A59447CA
                                                                                                                                                                    SHA-256:BAAFF4F2F34E31BDC352CF67CAF1FD9CDF024BE1418B3B59F081989A3B220BEA
                                                                                                                                                                    SHA-512:DCFAA7365B7B1841CA68CB5320AFA36CE7CD8435A1D796EB002A6DF54EB379CB44BD1C9EE986BD1E02B5A91964FC8ADC697878600247543BEE2BD74A030FF348
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.792 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/02/12-20:39:45.794 25a4 Recovering log #3.2024/02/12-20:39:45.795 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):5.21292172994544
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oeEF34q2PCHhJ23oH+TcwtfrK+IFUt8de89JZmw+de73DkwOCHhJ23oH+TcwtfrF:oeEFIvBYeb23FUt8de8H/+den56Yeb3J
                                                                                                                                                                    MD5:DA35433A7F01C811EFB4829CE7B16BB2
                                                                                                                                                                    SHA1:7420EE59FFAC8B90E43C6B05D6E50B53A59447CA
                                                                                                                                                                    SHA-256:BAAFF4F2F34E31BDC352CF67CAF1FD9CDF024BE1418B3B59F081989A3B220BEA
                                                                                                                                                                    SHA-512:DCFAA7365B7B1841CA68CB5320AFA36CE7CD8435A1D796EB002A6DF54EB379CB44BD1C9EE986BD1E02B5A91964FC8ADC697878600247543BEE2BD74A030FF348
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.792 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/02/12-20:39:45.794 25a4 Recovering log #3.2024/02/12-20:39:45.795 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):811
                                                                                                                                                                    Entropy (8bit):4.050474979418348
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:G0nYUtypD3RUovhC+lvBOL+t3IvB62SCKRCCG:LYUtyp1vxdBllIpP6/G
                                                                                                                                                                    MD5:22543461DE0A7879F60028B903E8A014
                                                                                                                                                                    SHA1:6CC50F5F2F6846A4DB8CF5B4A06BD6C7EDD6528B
                                                                                                                                                                    SHA-256:E7C5405F88AE4F5C408D0CDFD5BA7DD295A3C3DE6CECE3F1FE7FBE3D80BE97F8
                                                                                                                                                                    SHA-512:AA89E482A62FEA4AB7C9E48355802749FD2BA56FA4FA8AC894876999A53D8FA63DB90C2A5F9A80F17A64FF42C8F49F36EB15F591D68623CBBB0CC468F7BF679F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.|.................9_.....'\c..................9_.......f-.................__global... .|.&R.................__global... ./....................__global... ..T...................__global... ..p...................22_........H.................22_.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):342
                                                                                                                                                                    Entropy (8bit):5.225211020797745
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oegL4q2PCHhJ23oH+TcwtfrzAdIFUt8delJZmw+dekj3DkwOCHhJ23oH+Tcwtfrm:oeNvBYeb9FUt8def/+deE56Yeb2J
                                                                                                                                                                    MD5:D676EDF01E366E4C851993A6811D07AB
                                                                                                                                                                    SHA1:DAA0C9B88E8DE5456A32E90FDF643C8532F7D4AD
                                                                                                                                                                    SHA-256:C1C842B70E5496F2E7FF354FAFDA3AF81B338A9050B8460CA1C88AC9FCE4C90A
                                                                                                                                                                    SHA-512:7E646E2A50B4AA2C60215B8C5D73E54E4296D25EAFEB7E14526BED75D70CCF5BCD3D6A85DEF9ACCB69F5D4BEC69BE3B33D9420C489733246E62869F219B97716
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.763 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/02/12-20:39:45.766 25a4 Recovering log #3.2024/02/12-20:39:45.767 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):342
                                                                                                                                                                    Entropy (8bit):5.225211020797745
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:oegL4q2PCHhJ23oH+TcwtfrzAdIFUt8delJZmw+dekj3DkwOCHhJ23oH+Tcwtfrm:oeNvBYeb9FUt8def/+deE56Yeb2J
                                                                                                                                                                    MD5:D676EDF01E366E4C851993A6811D07AB
                                                                                                                                                                    SHA1:DAA0C9B88E8DE5456A32E90FDF643C8532F7D4AD
                                                                                                                                                                    SHA-256:C1C842B70E5496F2E7FF354FAFDA3AF81B338A9050B8460CA1C88AC9FCE4C90A
                                                                                                                                                                    SHA-512:7E646E2A50B4AA2C60215B8C5D73E54E4296D25EAFEB7E14526BED75D70CCF5BCD3D6A85DEF9ACCB69F5D4BEC69BE3B33D9420C489733246E62869F219B97716
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2024/02/12-20:39:45.763 25a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/02/12-20:39:45.766 25a4 Recovering log #3.2024/02/12-20:39:45.767 25a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):120
                                                                                                                                                                    Entropy (8bit):3.32524464792714
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
                                                                                                                                                                    MD5:A397E5983D4A1619E36143B4D804B870
                                                                                                                                                                    SHA1:AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
                                                                                                                                                                    SHA-256:9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
                                                                                                                                                                    SHA-512:4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):13
                                                                                                                                                                    Entropy (8bit):2.7192945256669794
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:NYLFRQI:ap2I
                                                                                                                                                                    MD5:BF16C04B916ACE92DB941EBB1AF3CB18
                                                                                                                                                                    SHA1:FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
                                                                                                                                                                    SHA-256:7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
                                                                                                                                                                    SHA-512:F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:117.0.2045.47

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29dec.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29e78.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29e88.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a2ae.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a2be.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2a7de.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ce71.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3080f.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF332e8.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF334cd.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3377c.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF35f09.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ada6.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ae23.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ae62.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3d487.TMP (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):44170
                                                                                                                                                                    Entropy (8bit):6.0905296069531945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kyCLmZtitR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynztGhOxqQoRTuiVIos
                                                                                                                                                                    MD5:0EE62D12066214D647B966FF48FB78F8
                                                                                                                                                                    SHA1:2449999B5FE1F9A2D7D1AD6553CA5B81600DD758
                                                                                                                                                                    SHA-256:1E148C18BF71F14FFFED1C270E6CCD92D1A88A24AA63C7C7CF5FC4544388C263
                                                                                                                                                                    SHA-512:9304A8B576BC738098F975B344F1D311807EB23D49940080E714F2CE1E6EDD09DCF7B2B262DF3F00631A574637A248DD5B2C3F87DFB781145692744C61C4EE7C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):47
                                                                                                                                                                    Entropy (8bit):4.3818353308528755
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
                                                                                                                                                                    MD5:48324111147DECC23AC222A361873FC5
                                                                                                                                                                    SHA1:0DF8B2267ABBDBD11C422D23338262E3131A4223
                                                                                                                                                                    SHA-256:D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
                                                                                                                                                                    SHA-512:E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):35
                                                                                                                                                                    Entropy (8bit):4.014438730983427
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
                                                                                                                                                                    MD5:BB57A76019EADEDC27F04EB2FB1F1841
                                                                                                                                                                    SHA1:8B41A1B995D45B7A74A365B6B1F1F21F72F86760
                                                                                                                                                                    SHA-256:2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
                                                                                                                                                                    SHA-512:A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"forceServiceDetermination":false}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):50
                                                                                                                                                                    Entropy (8bit):3.9904355005135823
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:0xXF/XctY5GUf+:0RFeUf+
                                                                                                                                                                    MD5:E144AFBFB9EE10479AE2A9437D3FC9CA
                                                                                                                                                                    SHA1:5AAAC173107C688C06944D746394C21535B0514B
                                                                                                                                                                    SHA-256:EB28E8ED7C014F211BD81308853F407DF86AEBB5F80F8E4640C608CD772544C2
                                                                                                                                                                    SHA-512:837D15B3477C95D2D71391D677463A497D8D9FFBD7EB42E412DA262C9B5C82F22CE4338A0BEAA22C81A06ECA2DF7A9A98B7D61ECACE5F087912FD9BA7914AF3F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):575056
                                                                                                                                                                    Entropy (8bit):7.999649474060713
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
                                                                                                                                                                    MD5:BE5D1A12C1644421F877787F8E76642D
                                                                                                                                                                    SHA1:06C46A95B4BD5E145E015FA7E358A2D1AC52C809
                                                                                                                                                                    SHA-256:C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
                                                                                                                                                                    SHA-512:FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)*d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(|.6.:..f!.>...?M.8......P.D.J.I4.<...*.y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z*.{nZ~d.V.4.u.K.V.......X.<p..cz..>*....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):86
                                                                                                                                                                    Entropy (8bit):4.3751917412896075
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
                                                                                                                                                                    MD5:16B7586B9EBA5296EA04B791FC3D675E
                                                                                                                                                                    SHA1:8890767DD7EB4D1BEAB829324BA8B9599051F0B0
                                                                                                                                                                    SHA-256:474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
                                                                                                                                                                    SHA-512:58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b8b57165-0fad-4bd3-9de4-2e88a785f17b.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):44641
                                                                                                                                                                    Entropy (8bit):6.0953522740122965
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:zDXzgWPsj/qlGJqIY8GB4kO3LmZ1uLh3TUuN/uKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7yn/tKoRTuiVIos
                                                                                                                                                                    MD5:2E8128C2235692919B7C089EE6BDBD6C
                                                                                                                                                                    SHA1:71457F6C9DA44F261CD3FB695CD13BEB6E00E952
                                                                                                                                                                    SHA-256:B44AD4CD949CBFE7FCAA9BEE1A461251678BD50EC6200EFD7C2D33A8D1F425A9
                                                                                                                                                                    SHA-512:BB342A76C041FD5FEACC36DFBC953FAE90840C80EA991FE98C13CF33F9F78FC3A86F5A62705CAC25BF346F8F7F5869B08500A3798E602DE02927FEFEDCACA119
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bd83ef4e-7710-4e16-ac83-f03d0d52a1df.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092354970804881
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXOgQLmZ1uEK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXLdKoRTuiVIoV
                                                                                                                                                                    MD5:33E6C41DDD136DD4B23A86BCA6F60FD4
                                                                                                                                                                    SHA1:9D2CAC9A22F10F4F1C9A22023C32BD039D7CE0B8
                                                                                                                                                                    SHA-256:A482C11A70020A1E50F9D437919F9835E1699EE8704B60E8912DA567CDF52275
                                                                                                                                                                    SHA-512:7B79FDE38F7C86595996506955D531C6D206AC4784C3768E477CAE85A5D3305BAC18EF0C11F9E5632AD6EF0B4FD7A2D85DE57D91E36139BF90B0A5CEF7844FE1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\bf024648-e250-4c48-be14-4c3dcecd19ce.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092364474018913
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:73DXzgWPsj/qlGJqIY8GB4xXORwLmZ1uEK3D0bKuKwWE7RTupzKscDX//NPC1oV:73/Ps+wsI7yOXadKoRTuiVIoV
                                                                                                                                                                    MD5:0FD4D00A9CAACDDB3077CF47A8F7DBDE
                                                                                                                                                                    SHA1:814F2B4858FCC6A11AF271E9128D63C1A4DC3059
                                                                                                                                                                    SHA-256:F014C123BAFCCD0E22A2F8B1CDEDD4F1FA02936895677F93B2704DB503654146
                                                                                                                                                                    SHA-512:37C59101B4110B08CF9C9267A480F8B9E20FE350419C741846AEEF14973F0834E3B555AE9A7BB5D36402A4872395DFE722732358BA704D1EB1D813640D90789E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"A3A9D6F712BAB0D71355FF768606492CF4B47907F29FF0D0314BDAA720054D66\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e90fd1aa-ca90-4bd0-b37a-2a1be28728f5.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):45610
                                                                                                                                                                    Entropy (8bit):6.092343906776825
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:5DXzgWPsj/qlGJqIY8GB4xXOvULmZ1udK3D0bKuKwWE7RTupzKscDX//NPC1oV:5/Ps+wsI7yOXgMKoRTuiVIoV
                                                                                                                                                                    MD5:5CF2432D2A657D2D61E4F226731FC1F6
                                                                                                                                                                    SHA1:D9DEFE0170941872DFB79F85F278E590FDD22804
                                                                                                                                                                    SHA-256:9EDD0A7113332BD34751FD02CC3825AC4DBDA9983DC774AB871A1D624149FAC0
                                                                                                                                                                    SHA-512:F1B95699ED2234C84E79FF9A17A34299C3789EEE34042970CACE9307E1E6E4470A05E9DE3A0B8EA6EDC0CB0AD20C60A0BF71FEB4BA5ED618A263D1CC963274EB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1707766791"},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0V

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2278
                                                                                                                                                                    Entropy (8bit):3.835470964031477
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:uiTrlKxrgxyxl9Il8uQY0HP6g5iU4jnIEIy+pWDd1rc:mLYJ0HCOijIy+pZ
                                                                                                                                                                    MD5:3DF6E26FE89C36326790E39931037E27
                                                                                                                                                                    SHA1:9A4D0309FBF18B4FAC15E4C76860FC55409EB87C
                                                                                                                                                                    SHA-256:51A831B5580AD0830EF5F055DB28D88EBF0CC174E3160E50A979EDC00CC792E4
                                                                                                                                                                    SHA-512:9FDB5B840DDEF13A6E3F3803F1DD2DA6EC8E2D30979E32D50E3B946BC3D81BF88B84F1C7102A164E9F3493760D775E7040346E692D1D7F15D7B3C3911F777EB4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.L.k.l.p.f.N.d.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.m.1.z.k.S.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4622
                                                                                                                                                                    Entropy (8bit):4.000708733188152
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:yYUN0/UpVP1EKilmcIYZJbCQpLZbQgQ2L5:ybq/UpVdAIY3b5bQGL5
                                                                                                                                                                    MD5:D35FDE73C5DD2848410537BA9B9280E7
                                                                                                                                                                    SHA1:817CD5C8C12436684BEE2F0FCA8F94C2579D3859
                                                                                                                                                                    SHA-256:5CEDE3D369498A1347A5EBF138CEE01305341C0138B37022F8FE65536F7FC281
                                                                                                                                                                    SHA-512:AA0E2D39EE38A83592B09A0D84261573538EB79FF8D6E6887BE59F7023CAF3A28D72E922D88F0045D2C686E87CE17F34ACD250E327175B5EF000ADC0B3330162
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Z.+.z.s.i.O.t.d.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.t.m.1.z.k.S.

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\amert[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\58P5KO4N\fu[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):917504
                                                                                                                                                                    Entropy (8bit):6.5796923326287295
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaWTO:FqDEvCTbMWu7rQYlBQcBiT6rprG8auO
                                                                                                                                                                    MD5:67B659FCDDF2F8C738A12D6E482A076B
                                                                                                                                                                    SHA1:55770081B3C041F8CD03EE37642EDBA2579577F5
                                                                                                                                                                    SHA-256:69B8854E797EFA1FF495D96F6478162F4292C2CAF180EA4438DFBA8677D0930A
                                                                                                                                                                    SHA-512:90D46A119F640E71E1D18F5DD448A5742AAEACFADC91E4232BDC40CBC752311CDC68968AFE0C8C7FC9F47A63D974405371E58E9F9FACD00DBBC031DE83680AB4
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i.e.........."..........P......w.............@..........................`......8.....@...@.......@.....................d...|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\amert[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\fu[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):917504
                                                                                                                                                                    Entropy (8bit):6.5796923326287295
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaWTO:FqDEvCTbMWu7rQYlBQcBiT6rprG8auO
                                                                                                                                                                    MD5:67B659FCDDF2F8C738A12D6E482A076B
                                                                                                                                                                    SHA1:55770081B3C041F8CD03EE37642EDBA2579577F5
                                                                                                                                                                    SHA-256:69B8854E797EFA1FF495D96F6478162F4292C2CAF180EA4438DFBA8677D0930A
                                                                                                                                                                    SHA-512:90D46A119F640E71E1D18F5DD448A5742AAEACFADC91E4232BDC40CBC752311CDC68968AFE0C8C7FC9F47A63D974405371E58E9F9FACD00DBBC031DE83680AB4
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i.e.........."..........P......w.............@..........................`......8.....@...@.......@.....................d...|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ladas[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2368000
                                                                                                                                                                    Entropy (8bit):7.961235677287098
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:eUyifO8En01EXhKEuytmKpHc0Cy7d+oMaHOjLxdPrtCI:vSxmmhc0D7d19HO9fC
                                                                                                                                                                    MD5:3AD46004D0FBDA320BC0B683582FE08A
                                                                                                                                                                    SHA1:3DD6A47BD2C1BAF1950E0C8B9445DBB331026975
                                                                                                                                                                    SHA-256:3884AC010768A5FB727DE050321C82D99591B8DFD5F82ACA60987B55D343EBFC
                                                                                                                                                                    SHA-512:24C963EF5EC8DDDF25542DDF9D543F398E8D1474649A73AEAAD58033AE358C068B1D9B1E6FA9AF6134052FA2979445B27F104424D415AEB030EB091311E0D21E
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......p[...........@...........................[.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... ..,.........................@...bqhqoftp.....p@.....................@...grvnhumg.....`[.......#.............@....taggant.0...p[.."....$.............@...................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\niks[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1755648
                                                                                                                                                                    Entropy (8bit):7.944092570478896
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:XMp5Tjy4W4TOoWyaUeEetFfU3LhXaYLJnxpMYwP2RCspkBRzWhy3TEcO2:664TOo6tFWLxfZQ6CokjWh5
                                                                                                                                                                    MD5:64D74B4DCF40E24D3F163421AD180350
                                                                                                                                                                    SHA1:EE884429F86E6A694E4867D46EDF93307637EE93
                                                                                                                                                                    SHA-256:EBE7EB37705A453FE43B000BB31638040864F7AFCEC0161157EE0C78E0738CE1
                                                                                                                                                                    SHA-512:DF39465AD54A006C45DC5EFDC6E2494148C24394BF4671D7F6147B4F775F6C0AFABA6C189547ABC8A6462B6175734291A98E1EC96A5E75C97920563606C3FA4A
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............F.. ...`....@.. ....................... F...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...edffsevf.....`+......:..............@...xbfgsjgd. ....F.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\plaza[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3100160
                                                                                                                                                                    Entropy (8bit):7.975874249443056
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:gS9FJHxNhIc1HqApr8PK1ui4B3qRkFgjFCPQwpjuS+BWtB8xg9NMMIRwm:gS9FpxNCcMAGP6U0kFgov1+Rxg9aAm
                                                                                                                                                                    MD5:E2467950D27C4297353607B662102098
                                                                                                                                                                    SHA1:BC041DA517F37EDD108DD9E7E4E5AC1A15990591
                                                                                                                                                                    SHA-256:AC7B729CDC37128C14D5897A4BFB7AE4DB1E18373C283199331B72D6B4AAA09E
                                                                                                                                                                    SHA-512:16306B7B922B618814E2372160553C544B461B92E5ABF4AA60C3A845DDAFA02AF5387849FC9E63739CEC9A14088499547ED95C2BADE9E3956BDD3DC60EECD978
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....>....................@.......................................@... .. .... .. .......... ...:...\...x....................................................................................................................................8..................@............p......."...<..............@............@...0.......^..............@................p.......f..............@....................d...f..............@....rsrc...............................@..@.........Py.. ...(..................@....data....P"..p...N".................@...................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\well[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):307200
                                                                                                                                                                    Entropy (8bit):6.607531240037924
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:CbV6ZXz5ah5zdgijxgUo+j9cr04DdbzNlUpWu/AvKiK9nnPEe4E:CqDEvFo+yo4DdbbMWu/jrH
                                                                                                                                                                    MD5:DC7F1A461DBD6AE62D0F5E3A49C08385
                                                                                                                                                                    SHA1:3CC4CABE7D77A393955ECDB6BA13C92823A9924E
                                                                                                                                                                    SHA-256:F9C4751A5793E8B6B21A1985FD030BC294A7EE1B2F4657105F73595004E6A114
                                                                                                                                                                    SHA-512:FC304FAD785A63F6459E53D4DDFB384411A8B4204D715EB7DAB185006F19020CF86B43621DC660B52D5DF32EB8EDB815984BCB9F87C28E38B37C9139B14FCC99
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...$..e..........".................w.............@..........................0............@...@.......@.....................d...|....@..l`.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...l`...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\amert[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\ladas[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2368000
                                                                                                                                                                    Entropy (8bit):7.961235677287098
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:eUyifO8En01EXhKEuytmKpHc0Cy7d+oMaHOjLxdPrtCI:vSxmmhc0D7d19HO9fC
                                                                                                                                                                    MD5:3AD46004D0FBDA320BC0B683582FE08A
                                                                                                                                                                    SHA1:3DD6A47BD2C1BAF1950E0C8B9445DBB331026975
                                                                                                                                                                    SHA-256:3884AC010768A5FB727DE050321C82D99591B8DFD5F82ACA60987B55D343EBFC
                                                                                                                                                                    SHA-512:24C963EF5EC8DDDF25542DDF9D543F398E8D1474649A73AEAAD58033AE358C068B1D9B1E6FA9AF6134052FA2979445B27F104424D415AEB030EB091311E0D21E
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......p[...........@...........................[.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... ..,.........................@...bqhqoftp.....p@.....................@...grvnhumg.....`[.......#.............@....taggant.0...p[.."....$.............@...................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\niks[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1755648
                                                                                                                                                                    Entropy (8bit):7.944092570478896
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:XMp5Tjy4W4TOoWyaUeEetFfU3LhXaYLJnxpMYwP2RCspkBRzWhy3TEcO2:664TOo6tFWLxfZQ6CokjWh5
                                                                                                                                                                    MD5:64D74B4DCF40E24D3F163421AD180350
                                                                                                                                                                    SHA1:EE884429F86E6A694E4867D46EDF93307637EE93
                                                                                                                                                                    SHA-256:EBE7EB37705A453FE43B000BB31638040864F7AFCEC0161157EE0C78E0738CE1
                                                                                                                                                                    SHA-512:DF39465AD54A006C45DC5EFDC6E2494148C24394BF4671D7F6147B4F775F6C0AFABA6C189547ABC8A6462B6175734291A98E1EC96A5E75C97920563606C3FA4A
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............F.. ...`....@.. ....................... F...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...edffsevf.....`+......:..............@...xbfgsjgd. ....F.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\plaza[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3100160
                                                                                                                                                                    Entropy (8bit):7.975874249443056
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:gS9FJHxNhIc1HqApr8PK1ui4B3qRkFgjFCPQwpjuS+BWtB8xg9NMMIRwm:gS9FpxNCcMAGP6U0kFgov1+Rxg9aAm
                                                                                                                                                                    MD5:E2467950D27C4297353607B662102098
                                                                                                                                                                    SHA1:BC041DA517F37EDD108DD9E7E4E5AC1A15990591
                                                                                                                                                                    SHA-256:AC7B729CDC37128C14D5897A4BFB7AE4DB1E18373C283199331B72D6B4AAA09E
                                                                                                                                                                    SHA-512:16306B7B922B618814E2372160553C544B461B92E5ABF4AA60C3A845DDAFA02AF5387849FC9E63739CEC9A14088499547ED95C2BADE9E3956BDD3DC60EECD978
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....>....................@.......................................@... .. .... .. .......... ...:...\...x....................................................................................................................................8..................@............p......."...<..............@............@...0.......^..............@................p.......f..............@....................d...f..............@....rsrc...............................@..@.........Py.. ...(..................@....data....P"..p...N".................@...................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\well[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1166336
                                                                                                                                                                    Entropy (8bit):7.035421328659107
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aHh2+b+HdiJUt:CTvC/MTQYxsWR7aHh2+b+HoJU
                                                                                                                                                                    MD5:FC157BF81AB006D1BB0A542AAF499C53
                                                                                                                                                                    SHA1:2B5F22AC2158A90EAE8783E05E62171095BBDCE7
                                                                                                                                                                    SHA-256:CADCD8C01844EFD569E6D84E5CF516261A8E43450B2B22D8227A710EAA524909
                                                                                                                                                                    SHA-512:723F661B13ED7CC9444BA0C1038B2DB23716BDE32EF02F504131A4F11E5A23A9186EC527C0D9291F18194E7193D62687BE1F2A5385FFA37D3B1EA95AAAC2F8F8
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 35%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...$..e..........".................w.............@..........................0............@...@.......@.....................d...|....@..l`.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...l`...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\fu[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):917504
                                                                                                                                                                    Entropy (8bit):6.5796923326287295
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaWTO:FqDEvCTbMWu7rQYlBQcBiT6rprG8auO
                                                                                                                                                                    MD5:67B659FCDDF2F8C738A12D6E482A076B
                                                                                                                                                                    SHA1:55770081B3C041F8CD03EE37642EDBA2579577F5
                                                                                                                                                                    SHA-256:69B8854E797EFA1FF495D96F6478162F4292C2CAF180EA4438DFBA8677D0930A
                                                                                                                                                                    SHA-512:90D46A119F640E71E1D18F5DD448A5742AAEACFADC91E4232BDC40CBC752311CDC68968AFE0C8C7FC9F47A63D974405371E58E9F9FACD00DBBC031DE83680AB4
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i.e.........."..........P......w.............@..........................`......8.....@...@.......@.....................d...|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\ladas[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2368000
                                                                                                                                                                    Entropy (8bit):7.961235677287098
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:eUyifO8En01EXhKEuytmKpHc0Cy7d+oMaHOjLxdPrtCI:vSxmmhc0D7d19HO9fC
                                                                                                                                                                    MD5:3AD46004D0FBDA320BC0B683582FE08A
                                                                                                                                                                    SHA1:3DD6A47BD2C1BAF1950E0C8B9445DBB331026975
                                                                                                                                                                    SHA-256:3884AC010768A5FB727DE050321C82D99591B8DFD5F82ACA60987B55D343EBFC
                                                                                                                                                                    SHA-512:24C963EF5EC8DDDF25542DDF9D543F398E8D1474649A73AEAAD58033AE358C068B1D9B1E6FA9AF6134052FA2979445B27F104424D415AEB030EB091311E0D21E
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......p[...........@...........................[.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... ..,.........................@...bqhqoftp.....p@.....................@...grvnhumg.....`[.......#.............@....taggant.0...p[.."....$.............@...................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\niks[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1755648
                                                                                                                                                                    Entropy (8bit):7.944092570478896
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:XMp5Tjy4W4TOoWyaUeEetFfU3LhXaYLJnxpMYwP2RCspkBRzWhy3TEcO2:664TOo6tFWLxfZQ6CokjWh5
                                                                                                                                                                    MD5:64D74B4DCF40E24D3F163421AD180350
                                                                                                                                                                    SHA1:EE884429F86E6A694E4867D46EDF93307637EE93
                                                                                                                                                                    SHA-256:EBE7EB37705A453FE43B000BB31638040864F7AFCEC0161157EE0C78E0738CE1
                                                                                                                                                                    SHA-512:DF39465AD54A006C45DC5EFDC6E2494148C24394BF4671D7F6147B4F775F6C0AFABA6C189547ABC8A6462B6175734291A98E1EC96A5E75C97920563606C3FA4A
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............F.. ...`....@.. ....................... F...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...edffsevf.....`+......:..............@...xbfgsjgd. ....F.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\plaza[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3100160
                                                                                                                                                                    Entropy (8bit):7.975874249443056
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:gS9FJHxNhIc1HqApr8PK1ui4B3qRkFgjFCPQwpjuS+BWtB8xg9NMMIRwm:gS9FpxNCcMAGP6U0kFgov1+Rxg9aAm
                                                                                                                                                                    MD5:E2467950D27C4297353607B662102098
                                                                                                                                                                    SHA1:BC041DA517F37EDD108DD9E7E4E5AC1A15990591
                                                                                                                                                                    SHA-256:AC7B729CDC37128C14D5897A4BFB7AE4DB1E18373C283199331B72D6B4AAA09E
                                                                                                                                                                    SHA-512:16306B7B922B618814E2372160553C544B461B92E5ABF4AA60C3A845DDAFA02AF5387849FC9E63739CEC9A14088499547ED95C2BADE9E3956BDD3DC60EECD978
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....>....................@.......................................@... .. .... .. .......... ...:...\...x....................................................................................................................................8..................@............p......."...<..............@............@...0.......^..............@................p.......f..............@....................d...f..............@....rsrc...............................@..@.........Py.. ...(..................@....data....P"..p...N".................@...................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\well[1].exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1166336
                                                                                                                                                                    Entropy (8bit):7.035421328659107
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aHh2+b+HdiJUt:CTvC/MTQYxsWR7aHh2+b+HoJU
                                                                                                                                                                    MD5:FC157BF81AB006D1BB0A542AAF499C53
                                                                                                                                                                    SHA1:2B5F22AC2158A90EAE8783E05E62171095BBDCE7
                                                                                                                                                                    SHA-256:CADCD8C01844EFD569E6D84E5CF516261A8E43450B2B22D8227A710EAA524909
                                                                                                                                                                    SHA-512:723F661B13ED7CC9444BA0C1038B2DB23716BDE32EF02F504131A4F11E5A23A9186EC527C0D9291F18194E7193D62687BE1F2A5385FFA37D3B1EA95AAAC2F8F8
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 35%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...$..e..........".................w.............@..........................0............@...@.......@.....................d...|....@..l`.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...l`...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\activity-stream.discovery_stream.json (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1249
                                                                                                                                                                    Entropy (8bit):4.929811569236458
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:Y4ZGUcCumGJsYArzmy+3z+cJXn4Mj4xUz4+Eibw4DKe4lextS:YqGUcNRJsYAHmH3icJXn4Mj4xUz4+Ei+
                                                                                                                                                                    MD5:0A03D19B827435AF3F22C81B5F11E4EB
                                                                                                                                                                    SHA1:F06E2D60F88BAF9B49221037961B8BC6026BB309
                                                                                                                                                                    SHA-256:CDA70A5AF04F8283F2F8AAA667FC3144ADEE653F7C523A56395DA79B7AF56289
                                                                                                                                                                    SHA-512:589F94A469EB4703BB0B0BC0168CB633887A896EEB63B4011B4CD025D126B5F2E2DC0690777DE1C2F50FAE60AAB644C6B739C6120BB38B82A2BFEDD8E7C0EE4C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"spocs":{"lastUpdated":1707773945128,"spocs":{"settings":{"feature_flags":{"spoc_v2":true,"collections":false},"spocsPerNewTabs":1,"domainAffinityParameterSets":{"default":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":10,"perfectCombinedDomainScore":2,"multiDomainBoost":0,"itemScoreFactor":1},"fully-personalized":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":10,"perfectCombinedDomainScore":2,"itemScoreFactor":0.01,"multiDomainBoost":0},"fully-personalized-domains":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":1,"perfectCombinedDomainScore":10,"itemScoreFactor":0.01,"multiDomainBoost":0}},"timeSegments":[{"id":"week-1","startTime":432000,"endTime":0,"weightPosition":1},{"id":"week-2","startTime":864000,"endTime":432000,"weightPosition":1},{"id":"week-3","startTime":1296000,"endTime":864000,"weightPosition":1},{"id":"week-4","startTime":17280

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\activity-stream.discovery_stream.json.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1249
                                                                                                                                                                    Entropy (8bit):4.929811569236458
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:Y4ZGUcCumGJsYArzmy+3z+cJXn4Mj4xUz4+Eibw4DKe4lextS:YqGUcNRJsYAHmH3icJXn4Mj4xUz4+Ei+
                                                                                                                                                                    MD5:0A03D19B827435AF3F22C81B5F11E4EB
                                                                                                                                                                    SHA1:F06E2D60F88BAF9B49221037961B8BC6026BB309
                                                                                                                                                                    SHA-256:CDA70A5AF04F8283F2F8AAA667FC3144ADEE653F7C523A56395DA79B7AF56289
                                                                                                                                                                    SHA-512:589F94A469EB4703BB0B0BC0168CB633887A896EEB63B4011B4CD025D126B5F2E2DC0690777DE1C2F50FAE60AAB644C6B739C6120BB38B82A2BFEDD8E7C0EE4C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"spocs":{"lastUpdated":1707773945128,"spocs":{"settings":{"feature_flags":{"spoc_v2":true,"collections":false},"spocsPerNewTabs":1,"domainAffinityParameterSets":{"default":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":10,"perfectCombinedDomainScore":2,"multiDomainBoost":0,"itemScoreFactor":1},"fully-personalized":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":10,"perfectCombinedDomainScore":2,"itemScoreFactor":0.01,"multiDomainBoost":0},"fully-personalized-domains":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":1,"perfectCombinedDomainScore":10,"itemScoreFactor":0.01,"multiDomainBoost":0}},"timeSegments":[{"id":"week-1","startTime":432000,"endTime":0,"weightPosition":1},{"id":"week-2","startTime":864000,"endTime":432000,"weightPosition":1},{"id":"week-3","startTime":1296000,"endTime":864000,"weightPosition":1},{"id":"week-4","startTime":17280

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\doomed\11335 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):133
                                                                                                                                                                    Entropy (8bit):4.982829973763396
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:C/iTKjz/EtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:SiNiclpJWw9LYX24Ztn
                                                                                                                                                                    MD5:890380930016CB7A375137180960FAFD
                                                                                                                                                                    SHA1:6D2038A63474706BE1C8D9AA67313DA58AA1B76B
                                                                                                                                                                    SHA-256:1F17F57B37CDAE82A64C81B31F9DD6F2604DD82C22C7A8E40D6FABFC86755EF4
                                                                                                                                                                    SHA-512:364ACB5C0586763B17BD88761C232C6038AA676382F9E36B67A5E72B467DC02B0DBC0D2FC8F093CB79F2C19E59A15C7E97FCC0E11C99E110CC4776020F5F096F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.WKG........e.tIe.tIF.X........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\doomed\21975 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):126
                                                                                                                                                                    Entropy (8bit):5.0339608574470684
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:IRlgTJt9D/l3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:IDgt1Riclp+OGb9LUxG0OKLtn
                                                                                                                                                                    MD5:5D4332CE508A8DE5B9A5E0473BCAF67B
                                                                                                                                                                    SHA1:D8EF71794757379C10A13763A98DAC1D594CA7CD
                                                                                                                                                                    SHA-256:F65D735BAED11CCE1CCCBA1F2F7E3E0CDB699BA736B7CD4F4B29D4C1F46D9C54
                                                                                                                                                                    SHA-512:801442855F0A5ABE757FCAC771C61037AB71934E78F79C5089051AE89029110EB29BB2167F957ACA20CCEB252B0FFE1D30EC17AB4C9A999020055C6D5A948B9B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:............e.tIe.tJF.X........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\doomed\26378 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):113
                                                                                                                                                                    Entropy (8bit):4.9160038830840715
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:O4c/uRhrNLtXNWbdUyGLk8rLtPQ0IIt:O7uRNEbdOx2Kt
                                                                                                                                                                    MD5:2780B62D2786788484BBE0A97FDFB92F
                                                                                                                                                                    SHA1:24570E2D3B6E9745EBD4540F7A2DEFFECDF0D17D
                                                                                                                                                                    SHA-256:6DDA4B7C8136D9AB7AC07472E52478F2AFF8F73A4056F46CD025E3974D0F7698
                                                                                                                                                                    SHA-512:34119ABF645EC27791E04F4F0CA36A0DE6CBC22B081E5AB5F8E4DC78A95F176479297DFB4B2DC6EC18D98E9B4B31A65456CD0FCA2009BF1125F92F86B282FF09
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:A..N........e.t8e.t8F.X........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\doomed\28297 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):133
                                                                                                                                                                    Entropy (8bit):4.982829973763396
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:C/iTKjz/EtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:SiNiclpJWw9LYX24Ztn
                                                                                                                                                                    MD5:890380930016CB7A375137180960FAFD
                                                                                                                                                                    SHA1:6D2038A63474706BE1C8D9AA67313DA58AA1B76B
                                                                                                                                                                    SHA-256:1F17F57B37CDAE82A64C81B31F9DD6F2604DD82C22C7A8E40D6FABFC86755EF4
                                                                                                                                                                    SHA-512:364ACB5C0586763B17BD88761C232C6038AA676382F9E36B67A5E72B467DC02B0DBC0D2FC8F093CB79F2C19E59A15C7E97FCC0E11C99E110CC4776020F5F096F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.WKG........e.tIe.tIF.X........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\doomed\29033

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):187
                                                                                                                                                                    Entropy (8bit):4.97946266029255
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:ef/i9ZRtl3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6TaxXA8AsO7W1Lt8AsO7WZ:eni9TPRiclp+OGb9LUxG0OKlmeO7WxtI
                                                                                                                                                                    MD5:7527E9F706A56FE4D3CA87A1890EFAB2
                                                                                                                                                                    SHA1:D91AE39D2D67D0983B7C9076817C1190C1E0C150
                                                                                                                                                                    SHA-256:177E2F995690C8B920FC7678F4DDFB0607FE0A63AB2DE56C1ECC4F52EA3660D4
                                                                                                                                                                    SHA-512:C623C243E8959EA6BD7397B239F92F70D87DD0E63F34DCB175A230546473F715523E99C0AB55F691F5A4B9B7DA91FF75F1F4CAD2DB67EB4679CF7B746E8C599A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:un..........e.t7e.t;F.X........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.net-response-time-onstart.3436.net-response-time-onstop.5170.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\doomed\31005 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10570
                                                                                                                                                                    Entropy (8bit):6.127079138384725
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:BAfamoKAf3iRyaXtoAfALPwPRjty8u7vFEf9ItfbaI8j3qSdFYPG3dmYPGm:BAfFoKAf3kHtoAfAMPR0xvFEfGTaIdu/
                                                                                                                                                                    MD5:4A0174EAF0F58A9156F24BE9F08288FA
                                                                                                                                                                    SHA1:CCC5DCB237255A2ED94419BF64F7BFA8954286CC
                                                                                                                                                                    SHA-256:42544718B5733A91DA1FFC285811F40B42AD078604B3DAB0CE9823273AEBAA44
                                                                                                                                                                    SHA-512:0868603CD5C2978F526E5FDD6FF7300096CC7FD8DDBF53017CD8644843F212DC71EF964719A03B114396F1E39FB0BA759017A20A7978FBF7525721354AD9F29D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"tiles":[{"id":74301,"name":"Amazon","url":"https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_da35efdf7fb6b20d4be6a53f3a5c7579d215346ca6420c0283354591&mfadid=adm","click_url":"https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1707763558474.12791&key=1707763558400900002.1&ctag=pd_sl_da35efdf7fb6b20d4be6a53f3a5c7579d215346ca6420c0283354591","image_url":"https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg","image_size":200,"impression_url":"https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Zbr4ZHZ4CDa4pbW1CbWfpbY7ReNxR3UIG8zInwYIFIVs9eYiGINHrwkiFXwxYIZjF8XgClWfC2X7R4dHQ8zJnErj%3DcO7R4dHQfz4Z2ZfplnHG3Z5FwqgCfX1p8d4Cxr1BINI9HuiF2z4Z2ZfplnHmcux%3DcvImauiF2zfQlWfp2%2B7ncqIr7VjGbuiF2zfCfk4Qxr4Qfnj9wWIBdvIpkY7R4TJr2uJREuHnEYgClnHr7wHG3vjnDuiF2zfCbY4BIWJ%3DcQIFdwJR2uiF2zfCbW4Wyy"},{"id":74925,"name":"Expedia","url":"https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219867.b115417125.g1.l1.e1C.m11707

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\1E3866B584D906DD8CB8840AB2070142E2DEA38A

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):113
                                                                                                                                                                    Entropy (8bit):4.9160038830840715
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:O4c/uRhrNLtXNWbdUyGLk8rLtPQ0IIt:O7uRNEbdOx2Kt
                                                                                                                                                                    MD5:2780B62D2786788484BBE0A97FDFB92F
                                                                                                                                                                    SHA1:24570E2D3B6E9745EBD4540F7A2DEFFECDF0D17D
                                                                                                                                                                    SHA-256:6DDA4B7C8136D9AB7AC07472E52478F2AFF8F73A4056F46CD025E3974D0F7698
                                                                                                                                                                    SHA-512:34119ABF645EC27791E04F4F0CA36A0DE6CBC22B081E5AB5F8E4DC78A95F176479297DFB4B2DC6EC18D98E9B4B31A65456CD0FCA2009BF1125F92F86B282FF09
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:A..N........e.t8e.t8F.X........H....:https://redirector.gvt1.com/edgedl/widevine-cdm/4.10.2557.0-win-x64.zip.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\2275F9569F28969C8FC69F9660A75ADD1F8B963B

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 200x200, components 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):18472
                                                                                                                                                                    Entropy (8bit):7.434700679404515
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:3libOz4wmZGQusT1VeiWBxCvcUxCvcU/AEyC:3KDdZrWBxCksCkEAEyC
                                                                                                                                                                    MD5:C1D352559012C0DFF6C4D8024ECC0CDB
                                                                                                                                                                    SHA1:8AA6A7FBA61F5BDEAEA99EB4CF96A33F58F9DCEC
                                                                                                                                                                    SHA-256:6E1ACACFE2DAD247C297AFE89158CA6903F14C81EDC47CF5FE24B18CC834B288
                                                                                                                                                                    SHA-512:945C1D23E7A9BF6BE7689C45349AE5A81928D32D1D6982E1E14777DCD955DD45F6EED8E699B54524BAD8B7116A342F83DC4608A1B074904803BE5BE7A2192494
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......Exif..II*.................Ducky.......\......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:325e6b3c-236a-4cb0-bc5d-ca3547a7d39f" xmpMM:DocumentID="xmp.did:67843F95795011E8AEF383E68A39EBCA" xmpMM:InstanceID="xmp.iid:67843F94795011E8AEF383E68A39EBCA" xmp:CreatorTool="Adobe Photoshop CC 2018 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a6bdd2c4-34fa-46ab-8f84-e4aa7013f273" stRef:documentID="adobe:docid:photoshop:a855630c-a97f-124d-b9fe-abb821769bdc"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............................

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\254256B27E0C48CF9B80B695F0B3B8CA84610495

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8378
                                                                                                                                                                    Entropy (8bit):6.089790359984328
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:PHfksVQuK+SrMY4gQXpy9iu45rsVQuK+SrMY4gQXpy9iu45/Mbm5uZGebZovNIct:vH3rNVo9Eg3rNVo9EGNbZovqcdBRdBr
                                                                                                                                                                    MD5:739E6544F2D044899C33BB1F01296604
                                                                                                                                                                    SHA1:3B8C3D26220F73B20A656ABB3517855E365C0D97
                                                                                                                                                                    SHA-256:A9D912186022C04966DAF86A290C9DBC11B486BA7D49AD6510FFF452526DB97C
                                                                                                                                                                    SHA-512:60FA9F739FD8A7761B06A3E1EF0E647491D1663B6B70C3D57908088A496BC59C9A9B6E63F0A5AB2144B7D4E2BDCCC0AC20859A71E392552AF238DD97CF6DE173
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"permissions":{},"data":{"attachment":{"hash":"0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0","size":7581,"filename":"asrouter.ftl","location":"main-workspace/ms-language-packs/4f1bcaa0-ddf9-43ef-aca3-8378c4d05582.ftl","mimetype":"application/octet-stream"},"id":"cfr-v1-en-US","last_modified":1648230346554}}./L...........e.tTe.tTF.X.e.s....q....:https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US.strongly-framed.1.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAAAAAAAAAAAA///ADwAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAXxMIIF7TCCA9WgAwIBAgISA9GY462VxzkuNQVlgf5UHctGMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzEqMCgGA1UECgwhVGhlIFVuaXZlcnNlIFNlY3VyaXR5IENvbXBhbnkgTHRkMSowKAYDVQQDDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQwHhcNMjQwMjExMTk0MDM2WhcNMjUwMjEwMTk0MDM2WjAmMSQwIgYDVQQDExtyZW1vdGUtc2V0dGl

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\4C863284CDA7F859EB300BED16DBCEF9517F1824

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):102
                                                                                                                                                                    Entropy (8bit):4.653010030558936
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:LLtmenJhaaau/Ktb9vX3XDkySLUxGTKlVX8sX3u+llln:F3hRglXDOLUxGbsHHl/n
                                                                                                                                                                    MD5:6C945FA102D18E795AC5227B5ED34D30
                                                                                                                                                                    SHA1:901FDCFE5ADF12E3725F222573743CB0C3987BA5
                                                                                                                                                                    SHA-256:65468C91FDFA893685AAFFCF474A4D15DF9743EDD29708B8963028EEDAE25567
                                                                                                                                                                    SHA-512:D536D4F9C0000B175E052C8B3F1EC90E8B7ED825A28C16B4E5AA66E541EB8A108C42D3AE473FC9F23462CB399650A9737035845FB872381FC7F313CE865F9975
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:l.........e.tSe.t7F.+........+....~predictor-origin,:https://www.youtube.com/.predictor::seen.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\58A756A796A86993036E1F0F79183245EE2ABF58

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:PEM certificate
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):13000
                                                                                                                                                                    Entropy (8bit):6.043517547797142
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:HcFp03cN9O/kqz51CcOm4pOqsqwJM7v0o5yyBa5m2/DfbaI8j3qq1e2iI2iG:HR3u9fiGLm4pUY7v00Vc5m2bTaIdq1M/
                                                                                                                                                                    MD5:27245ABAE3D3FE37253F4470CADF44B5
                                                                                                                                                                    SHA1:F9EB7237E87D29A486321C090E53BA59F3360B54
                                                                                                                                                                    SHA-256:2D62C882B70B4ABF7B47D0EAAAD3D69C5E40D798110FA9365DF1A5F3CBCCC0DB
                                                                                                                                                                    SHA-512:81E1DC559049D3402444FA98AA709060CFA86821EEE7CB911A8860A0AEC2136632D2997375953A08B2BF17F2637E1F34E5ABB9ABC7444A1AEF1C6E1DB211CEBE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:-----BEGIN CERTIFICATE-----.MIIDBTCCAougAwIBAgIIF4NGAGgAoGAwCgYIKoZIzj0EAwMwgaMxCzAJBgNVBAYT.AlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3pp.bGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTFFMEMGA1UEAww8Q29u.dGVudCBTaWduaW5nIEludGVybWVkaWF0ZS9lbWFpbEFkZHJlc3M9Zm94c2VjQG1v.emlsbGEuY29tMB4XDTIzMDgxMDE1NTQxMloXDTIzMTAyOTE1NTQxMlowgakxCzAJ.BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRYwFAYDVQQHEw1Nb3VudGFp.biBWaWV3MRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5D.bG91ZCBTZXJ2aWNlczE2MDQGA1UEAxMtcmVtb3RlLXNldHRpbmdzLmNvbnRlbnQt.c2lnbmF0dXJlLm1vemlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEYyj8.zLJVJc//j1xARfPx+oE/xqqM7O7tEZ9+XMWBeEQCqbJZRV8YS8VVq7Gffqygmqry.EGBhGRP5MX05XlfMO0cKletwojy/g/uWNoFAMYM3K/5640rSS53JHtjagJJEo4GD.MIGAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzAfBgNVHSME.GDAWgBSgHUoXT4zCKzVF8WPx2nBwp8744TA4BgNVHREEMTAvgi1yZW1vdGUtc2V0.dGluZ3MuY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwCgYIKoZIzj0EAwMD.aAAwZQIxAKnhW7gpmEDAerMLSrR9kyCc82//G8dmfBsMJJxS6HNtZJi79sTvtm

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\5B578F8321FC502AEADA5AE834B678EAFA227200

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8037
                                                                                                                                                                    Entropy (8bit):6.0818609897467235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:X1GH3iW1cURPAemdjjy95ej3uvpy66zQdVUYIfbaI8j3qf:XOahdjOLejevpy6mQdVUYITaIdf
                                                                                                                                                                    MD5:DB9D6DBC2A4C5E90B8CA4A51D52AE706
                                                                                                                                                                    SHA1:EC6EE9BC7F880BB00A749869FC7E7A154A9B5AB9
                                                                                                                                                                    SHA-256:B9CB8220B99F2F96FE81615B9889BD927CB6047BF4B99BC6DAA75E5B0E8BE931
                                                                                                                                                                    SHA-512:6874ED40707B332BE17BD29E7C2C14EEC265C280A074D9A26FF0CBEB485C7DF73B9FC928F2773B0B7E7646A280FEBA23250DCC440DE26219069264300350E802
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"settings":{"feature_flags":{"spoc_v2":true,"collections":false},"spocsPerNewTabs":1,"domainAffinityParameterSets":{"default":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":10,"perfectCombinedDomainScore":2,"multiDomainBoost":0,"itemScoreFactor":1},"fully-personalized":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":10,"perfectCombinedDomainScore":2,"itemScoreFactor":0.01,"multiDomainBoost":0},"fully-personalized-domains":{"recencyFactor":0.5,"frequencyFactor":0.5,"combinedDomainFactor":0.5,"perfectFrequencyVisits":1,"perfectCombinedDomainScore":10,"itemScoreFactor":0.01,"multiDomainBoost":0}},"timeSegments":[{"id":"week-1","startTime":432000,"endTime":0,"weightPosition":1},{"id":"week-2","startTime":864000,"endTime":432000,"weightPosition":1},{"id":"week-3","startTime":1296000,"endTime":864000,"weightPosition":1},{"id":"week-4","startTime":1728000,"endTime":1296000,"weightPosition":1},{"id"

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\6246CB7FA0A72939616FB877FF3FE3BF71EBC1BB

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):133
                                                                                                                                                                    Entropy (8bit):4.982829973763396
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:C/iTKjz/EtqiBMqEcldnX9XHWwrRzcSLYXqhHKRjF6T0tn:SiNiclpJWw9LYX24Ztn
                                                                                                                                                                    MD5:890380930016CB7A375137180960FAFD
                                                                                                                                                                    SHA1:6D2038A63474706BE1C8D9AA67313DA58AA1B76B
                                                                                                                                                                    SHA-256:1F17F57B37CDAE82A64C81B31F9DD6F2604DD82C22C7A8E40D6FABFC86755EF4
                                                                                                                                                                    SHA-512:364ACB5C0586763B17BD88761C232C6038AA676382F9E36B67A5E72B467DC02B0DBC0D2FC8F093CB79F2C19E59A15C7E97FCC0E11C99E110CC4776020F5F096F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.WKG........e.tIe.tIF.X........I....O^partitionKey=%28https%2Cfacebook.com%29,:https://www.facebook.com/video.necko:classified.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\69455E9F6ABEDFC78866EDEA94CB9D51C573A013

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):126
                                                                                                                                                                    Entropy (8bit):5.0339608574470684
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:IRlgTJt9D/l3BMqEcldnX+OGTAMrRzcSLUxGTKlLjOKf6T0tn:IDgt1Riclp+OGb9LUxG0OKLtn
                                                                                                                                                                    MD5:5D4332CE508A8DE5B9A5E0473BCAF67B
                                                                                                                                                                    SHA1:D8EF71794757379C10A13763A98DAC1D594CA7CD
                                                                                                                                                                    SHA-256:F65D735BAED11CCE1CCCBA1F2F7E3E0CDB699BA736B7CD4F4B29D4C1F46D9C54
                                                                                                                                                                    SHA-512:801442855F0A5ABE757FCAC771C61037AB71934E78F79C5089051AE89029110EB29BB2167F957ACA20CCEB252B0FFE1D30EC17AB4C9A999020055C6D5A948B9B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:............e.tIe.tJF.X........B....O^partitionKey=%28https%2Cyoutube.com%29,:https://www.youtube.com/.necko:classified.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\6D89348819C8881868053197CA0754F36784BF5F

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10570
                                                                                                                                                                    Entropy (8bit):6.127079138384725
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:BAfamoKAf3iRyaXtoAfALPwPRjty8u7vFEf9ItfbaI8j3qSdFYPG3dmYPGm:BAfFoKAf3kHtoAfAMPR0xvFEfGTaIdu/
                                                                                                                                                                    MD5:4A0174EAF0F58A9156F24BE9F08288FA
                                                                                                                                                                    SHA1:CCC5DCB237255A2ED94419BF64F7BFA8954286CC
                                                                                                                                                                    SHA-256:42544718B5733A91DA1FFC285811F40B42AD078604B3DAB0CE9823273AEBAA44
                                                                                                                                                                    SHA-512:0868603CD5C2978F526E5FDD6FF7300096CC7FD8DDBF53017CD8644843F212DC71EF964719A03B114396F1E39FB0BA759017A20A7978FBF7525721354AD9F29D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"tiles":[{"id":74301,"name":"Amazon","url":"https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_da35efdf7fb6b20d4be6a53f3a5c7579d215346ca6420c0283354591&mfadid=adm","click_url":"https://bridge.sfo1.ap01.net/ctp?version=16.0.0&ci=1707763558474.12791&key=1707763558400900002.1&ctag=pd_sl_da35efdf7fb6b20d4be6a53f3a5c7579d215346ca6420c0283354591","image_url":"https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg","image_size":200,"impression_url":"https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Zbr4ZHZ4CDa4pbW1CbWfpbY7ReNxR3UIG8zInwYIFIVs9eYiGINHrwkiFXwxYIZjF8XgClWfC2X7R4dHQ8zJnErj%3DcO7R4dHQfz4Z2ZfplnHG3Z5FwqgCfX1p8d4Cxr1BINI9HuiF2z4Z2ZfplnHmcux%3DcvImauiF2zfQlWfp2%2B7ncqIr7VjGbuiF2zfCfk4Qxr4Qfnj9wWIBdvIpkY7R4TJr2uJREuHnEYgClnHr7wHG3vjnDuiF2zfCbY4BIWJ%3DcQIFdwJR2uiF2zfCbW4Wyy"},{"id":74925,"name":"Expedia","url":"https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219867.b115417125.g1.l1.e1C.m11707

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\79B11E5B2A73707AF920FBB504E5C456E1698B13

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8047
                                                                                                                                                                    Entropy (8bit):6.092811250318148
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:8/Ek+SrMYugQhhfsFQc19Ek+SrMYugQhhfsFQc1tMbm5uZGebZovYG+6XP+6s:HrxNrx9NbZovYl6Xm6s
                                                                                                                                                                    MD5:DC177B82C2BF1B7B02180DC990E60CA9
                                                                                                                                                                    SHA1:6EAFD6D1FE3E140468539D99F42BB5E3705910B7
                                                                                                                                                                    SHA-256:46C01B64831647C70CA39F604BA264EBECE3C81458D4F0CF2FE32AC1608FFD4D
                                                                                                                                                                    SHA-512:48ACD9064BAD34805261EE091FED6CF779AEAB673999FFEE06E0D332A0A790ADF2E948D4B2D445817D0CD5D73CED9644859B5B9AFE0DF1E1C4AA1D3E6EABAEBC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...........e.tHe.tSF.B.e.tH...E....O^partitionKey=%28https%2Cgoogle.com%29,:https://accounts.google.com/.necko:classified.1.strongly-framed.0.security-info.FnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAAAAAAAAAAAAAAA///ADwAAAAEAOQFmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAWUMIIFkDCCA3igAwIBAgIRAKZzMNaal6wLCsPXBDDexwUwDQYJKoZIhvcNAQELBQAwgZIxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMSowKAYDVQQKDCFUaGUgVW5pdmVyc2UgU2VjdXJpdHkgQ29tcGFueSBMdGQxKjAoBgNVBAMMIVRoZSBVbml2ZXJzZSBTZWN1cml0eSBDb21wYW55IEx0ZDAeFw0yNDAyMTExOTM5NDBaFw0yNTAyMTAxOTM5NDBaMB4xHDAaBgNVBAMTE2FjY291bnRzLmdvb2dsZS5jb20wggEgMA0GCSqGSIb3DQEBAQUAA4IBDQAwggEIAoIBAQCmtggVpgb2H5JPRVAqYK2mjcpE7hG8s4mYvhnFyN7MEtANeVI0T7Eab2P+O3bAua3JgNb54GZ/zOVe8kRLiDV91VRk4uD0OU5YvVNAqjJqQg0q6KwFCeb+8Gc5VytAp3qCEpP/kTQkSYLJxLoGwswXUjO3w61+wipl93I8syUe0wlTmC7swYXfg8lu4HeCCaJqmyLB7DC8HhBnnop5xds/VmUKVP/3n61tgoOwhj04cOCAVVieK6xGFOG8OBjvqCuIZ+q2Wdc6ss6i+M0R6TBh+r9Rg7opOLAt2/zScnR+qk4kzya

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\7FEF50EB1C89E58D7202896295BED2C7C56D1C99

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):454009
                                                                                                                                                                    Entropy (8bit):7.997760018937475
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe/:tEsed2Xh9/bdzZe/
                                                                                                                                                                    MD5:94B0848B569025CD7421814A1FAA3E92
                                                                                                                                                                    SHA1:52B34BC99491573F73CBE4BC3BDFCAF8002A2D83
                                                                                                                                                                    SHA-256:F2D54CA04C881F4E51C624E876169B04096053AB7E6AD34A8FB85FD5179FACAC
                                                                                                                                                                    SHA-512:54D7C5862044953402154BF92BAE7AF42C57802DD8F1BC48AE663CCE2207EC71F523147CF26BC64F7CEC2EA744F797CF559E9B4ED35BAD56C9CB889CF31DEF66
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\97AE667565B6120DDEBF42730CC21468FE5AC36E

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):103
                                                                                                                                                                    Entropy (8bit):4.5749458012763435
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:b/NcjqTR/rlljXvX3XDkySLYXqhJX8sX3u+llln:bVSyTLXDOLYX2qsHHl/n
                                                                                                                                                                    MD5:D8D43875F796D5E7A40375BBE76369E6
                                                                                                                                                                    SHA1:5ACAB15CAFEF005234E1E0BDD717AC266C216F8B
                                                                                                                                                                    SHA-256:87193A05D30BE14AABCA443108B5EAF02FE0D5DA842CFCDF20A9AE3EBC10A85F
                                                                                                                                                                    SHA-512:FFF3AE8E676CA76CB5A49E76BD506C9AAAE84A96C9BA953D073EC433EDF0E0E4AC22F4BF546D385A26057F562FBDB121130EABB36E974EDE8A9C33F85E789C08
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:tI,N........e.tHe.t7F.A........,....~predictor-origin,:https://www.facebook.com/.predictor::seen.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\C886C15B36E63849FB9E86DCC97456303F590459

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106
                                                                                                                                                                    Entropy (8bit):4.509603273215922
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:w5LUllJW3oU5l+lljXvX3XDkDKVJ3uDVX8sX3u+llln:wVUlXWojjXDkw+qsHHl/n
                                                                                                                                                                    MD5:38E0263C5536BA313F9B5F634440AF4C
                                                                                                                                                                    SHA1:09F5FFDA9913A2CCFFCB1495260BB347D6ED929F
                                                                                                                                                                    SHA-256:2922DA7424CB8C6C607417F871CD5FB3EF5F2FC4431E23C46106E583CB588A29
                                                                                                                                                                    SHA-512:4C5A02AB520AD34C3F2BD90913CCBC8992E4E7B230BEBF9F327059C73F9E07643E9A913312CFB5B75DB2C03A45881188A33C8DD7AAB76700EB7FD7E6C6631BE9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:............e.tHe.t4F........../....~predictor-origin,:https://accounts.google.com/.predictor::seen.1.....

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):38820
                                                                                                                                                                    Entropy (8bit):5.254952459253209
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:yPtFYceo07uKtwzn+eV6cUmHxoZt6cUmHJkNTBdHOT5Qhh7veKmt9KZl:4eo07uKtwzn+en9H49HJk/dHOTij759l
                                                                                                                                                                    MD5:E2D7BC1592C3C461AE2087409E469802
                                                                                                                                                                    SHA1:F6CAD6D2F51E7E6DAA346A60E846AB737C807112
                                                                                                                                                                    SHA-256:D45B2410D4B3F61C9B78C5FEB2A720D835B256BD6C862B4552447616F4E6990C
                                                                                                                                                                    SHA-512:CEC59F2B321872AA112B218F5D6704FEEA8812939B73A16742A92C9DD68299F57D6F70B20E8E7B41F29F199DF179FDE80A52534C470F8135AA757D8F610BABA0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:<!doctype html>.<html>. <head>. <meta charset="utf-8">. <meta http-equiv="Content-Security-Policy" content="default-src 'none'; object-src 'none'; script-src resource: chrome:; connect-src https:; img-src https: data: blob: chrome:; style-src 'unsafe-inline';">. <meta name="color-scheme" content="light dark">. <title data-l10n-id="newtab-page-title"></title>. <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>. <link rel="localization" href="branding/brand.ftl" />. <link rel="localization" href="toolkit/branding/brandings.ftl" />. <link rel="localization" href="browser/newtab/newtab.ftl" />. <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />. <link rel="stylesheet" href="chrome://activity-stream/content/css/activity-stream.css" />. </head>. Cached: Thu, 05 Oct 2023 08:19:31 GMT -->. <body class="activity-stream">. <div id="header-asrouter-container" role="presentation"></div>. <div id="r

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\startupCache\scriptCache-child-new.bin

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2029892
                                                                                                                                                                    Entropy (8bit):4.701163800593069
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:v6JQC2xqco+d487l/bpuoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ibn:oRcNdR7l/bps6BjUNRc
                                                                                                                                                                    MD5:C11FD995042792A4BD826FF452E7885F
                                                                                                                                                                    SHA1:CF5C54A6A343046E7E22BFA4F779270D9DDB13F8
                                                                                                                                                                    SHA-256:2F1808342122464BD43DE11B66A201CB73866C51ED8860A9B5C228B398F7DC19
                                                                                                                                                                    SHA-512:FBBDC2A33280FFD7F4663C80CADC8169BFEDF7A2C81D8793091B7D5D315461F39A68CA025744D0658730CF59E0515448A354804CA7867096B766CE1F75A7251C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozXDRcachev003.....[.%i9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\startupCache\scriptCache-child.bin (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2029892
                                                                                                                                                                    Entropy (8bit):4.701163800593069
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:v6JQC2xqco+d487l/bpuoykPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAg+XdN43Ibn:oRcNdR7l/bps6BjUNRc
                                                                                                                                                                    MD5:C11FD995042792A4BD826FF452E7885F
                                                                                                                                                                    SHA1:CF5C54A6A343046E7E22BFA4F779270D9DDB13F8
                                                                                                                                                                    SHA-256:2F1808342122464BD43DE11B66A201CB73866C51ED8860A9B5C228B398F7DC19
                                                                                                                                                                    SHA-512:FBBDC2A33280FFD7F4663C80CADC8169BFEDF7A2C81D8793091B7D5D315461F39A68CA025744D0658730CF59E0515448A354804CA7867096B766CE1F75A7251C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozXDRcachev003.....[.%i9.resource://gre/modules/TelemetryControllerContent.sys.mjsU.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerContent.sys.mjs.........6.resource://gre/modules/TelemetryControllerBase.sys.mjsR.jsloader/non-syntactic/module/resource/gre/modules/TelemetryControllerBase.sys.mjs.........+.resource://gre/modules/AppConstants.sys.mjsG.jsloader/non-syntactic/module/resource/gre/modules/AppConstants.sys.mjs.&..T....".resource://gre/modules/Log.sys.mjs>.jsloader/non-syntactic/module/resource/gre/modules/Log.sys.mjs8C..Hp...).resource://gre/modules/XPCOMUtils.sys.mjsE.jsloader/non-syntactic/module/resource/gre/modules/XPCOMUtils.sys.mjs.....3...*.chrome://global/content/process-content.jsG.mm/script/resource/gre/chrome/toolkit/content/global/process-content.js@........6.resource://gre/modules/extensionProcessScriptLoader.js>.mm/script/resource/gre/modules/extensionProcessScriptLoader.js ........5.resource://gre/modules/ExtensionProcessScript.sys.mjsQ.j

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\startupCache\scriptCache-new.bin

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10873580
                                                                                                                                                                    Entropy (8bit):4.7305176783210925
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:98304:Iv8cW5IBmSaVgdyGn/SSyaZ+EnJH4m9G8NPm:IvDlmSaVBGn/SHaZ+eJH4m9VNPm
                                                                                                                                                                    MD5:1FA685589604823FDB7AF7AAE9372A63
                                                                                                                                                                    SHA1:04DF4E8CBEB5B56EC6AD65B93D543D3FAAEA1E44
                                                                                                                                                                    SHA-256:325493A7643A10D2575265BC8ABF9DACC338C87F16714810FFA335991D30D9D2
                                                                                                                                                                    SHA-512:B93961FC3FD77FA8EA7DD8EB490C9723833DDC81B3178BC09D711A6EEF25AC678C46EC815D8CC63AC84705E8EBDABC74663164849ACEAF90FF70AB3AFBC74E2E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozXDRcachev003.B......3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5...1.resource://gre/modules/EnterprisePolicies.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePolicies.sys.mjs.m.......7.resource://gre/modules/EnterprisePoliciesParent.sys.mjsS.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePoliciesParent.sys.mjs.s..P....(.resource://gre

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\startupCache\scriptCache.bin (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10873580
                                                                                                                                                                    Entropy (8bit):4.7305176783210925
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:98304:Iv8cW5IBmSaVgdyGn/SSyaZ+EnJH4m9G8NPm:IvDlmSaVBGn/SHaZ+eJH4m9VNPm
                                                                                                                                                                    MD5:1FA685589604823FDB7AF7AAE9372A63
                                                                                                                                                                    SHA1:04DF4E8CBEB5B56EC6AD65B93D543D3FAAEA1E44
                                                                                                                                                                    SHA-256:325493A7643A10D2575265BC8ABF9DACC338C87F16714810FFA335991D30D9D2
                                                                                                                                                                    SHA-512:B93961FC3FD77FA8EA7DD8EB490C9723833DDC81B3178BC09D711A6EEF25AC678C46EC815D8CC63AC84705E8EBDABC74663164849ACEAF90FF70AB3AFBC74E2E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozXDRcachev003.B......3.resource://gre/modules/MainProcessSingleton.sys.mjsO.jsloader/non-syntactic/module/resource/gre/modules/MainProcessSingleton.sys.mjs.........5.resource://gre/modules/CustomElementsListener.sys.mjsQ.jsloader/non-syntactic/module/resource/gre/modules/CustomElementsListener.sys.mjs....H....'.resource:///modules/BrowserGlue.sys.mjsF.jsloader/non-syntactic/module/resource/app/modules/BrowserGlue.sys.mjs.........1.resource://gre/modules/ActorManagerParent.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/ActorManagerParent.sys.mjs.....R...'.resource://gre/modules/XULStore.sys.mjsC.jsloader/non-syntactic/module/resource/gre/modules/XULStore.sys.mjs.7..x5...1.resource://gre/modules/EnterprisePolicies.sys.mjsM.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePolicies.sys.mjs.m.......7.resource://gre/modules/EnterprisePoliciesParent.sys.mjsS.jsloader/non-syntactic/module/resource/gre/modules/EnterprisePoliciesParent.sys.mjs.s..P....(.resource://gre

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\startupCache\urlCache-new.bin

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3674
                                                                                                                                                                    Entropy (8bit):4.793862779614733
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:hrPOwneU3deLVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNF:J2FU3Wu38qgbkgbIKKRCUOt9Jr/dR
                                                                                                                                                                    MD5:4D1F8F6459C0E1EE2B61C3C63A02C637
                                                                                                                                                                    SHA1:A18A00F14AE00BF13C1E12976825E0C6B3781024
                                                                                                                                                                    SHA-256:E11006AA2F545867BD3DC2BB3390AA9CA50EF521A1222203AA03C1045A9A5E82
                                                                                                                                                                    SHA-512:BC83185E5D2A21BCDCF1DE54F033EC8B17DAF478E99EBB30EA9935A434FD28A95876A0CA0AFEEA3445BF429A6A846DC42D40C0DD7E7B015DC145C006E16783AB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozURLcachev003.B...ti.j._.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\xulstore.json.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.g.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\addonStartup.json.lz4.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ftl.1.

                                                                                                                                                                    C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\24a4ohrz.default-release\startupCache\urlCache.bin (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3674
                                                                                                                                                                    Entropy (8bit):4.793862779614733
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:hrPOwneU3deLVegWWKmWtoBYjYdYgbbYgbqhNTKWeRryLPZefSyWr9HicStpRtNF:J2FU3Wu38qgbkgbIKKRCUOt9Jr/dR
                                                                                                                                                                    MD5:4D1F8F6459C0E1EE2B61C3C63A02C637
                                                                                                                                                                    SHA1:A18A00F14AE00BF13C1E12976825E0C6B3781024
                                                                                                                                                                    SHA-256:E11006AA2F545867BD3DC2BB3390AA9CA50EF521A1222203AA03C1045A9A5E82
                                                                                                                                                                    SHA-512:BC83185E5D2A21BCDCF1DE54F033EC8B17DAF478E99EBB30EA9935A434FD28A95876A0CA0AFEEA3445BF429A6A846DC42D40C0DD7E7B015DC145C006E16783AB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozURLcachev003.B...ti.j._.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\xulstore.json.;.C:\Program Files\Mozilla Firefox\distribution\policies.json.3.chrome/browser/content/browser/built_in_addons.json.g.C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\addonStartup.json.lz4.%.chrome/toolkit/content/global/xul.css...res/contenteditable.css.$.chrome/toolkit/res/counterstyles.css...res/designmode.css...chrome/toolkit/res/forms.css...chrome/toolkit/res/html.css...chrome/toolkit/res/mathml.css...chrome/toolkit/res/noframes.css...chrome/toolkit/res/quirk.css.!.chrome/toolkit/res/scrollbars.css...res/svg.css...chrome/toolkit/res/ua.css.0.chrome/en-US/locale/en-US/global/intl.properties.I.chrome/en-US/locale/en-US/mozapps/downloads/unknownContentType.properties.-.chrome/en-US/locale/branding/brand.properties.=.chrome/en-US/locale/en-US/global/layout/htmlparser.properties.1.localization/en-US/toolkit/about/aboutPlugins.ftl.1.

                                                                                                                                                                    C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2399232
                                                                                                                                                                    Entropy (8bit):7.932723171864367
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:AtNjudw+TeIsz5y48CU+1VvWlLt0YiO7N+9k/tm5lxMTGiR9X:XCTy48CU+1VIJ0XO8uVm5/uGiH
                                                                                                                                                                    MD5:11A2A91D1B8C9B3B0784D70A78F2DA6F
                                                                                                                                                                    SHA1:5ECB42524C51DEA5E2377419F77C25ED8FEDF0B2
                                                                                                                                                                    SHA-256:A57A3B08BFB8AEC37A412A829BAF276CE0DD2782927CCC925F4509C97680EA73
                                                                                                                                                                    SHA-512:5D29BCA16E2733DEA93D571783561CBCF229C908D104EEB3F2080D59141F945534E76A9C4EE4046D91DC62F68E47902625F4215EA782F4BD9D4B0E41B7177E78
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 47%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....,.......@\...........@..........................p\......%...@.................................T...h....p.............................................................................................................. . .`..........................@....rsrc........p... ..................@....idata ............................@... .0,.......... ..............@...zcmtppku.`....@..T..."..............@...kmucpvwr.....0\......v$.............@....taggant.0...@\.."...z$.............@...........................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\RageMP131\RageMP131.exe:Zone.Identifier

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):26
                                                                                                                                                                    Entropy (8bit):3.95006375643621
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:ggPYV:rPYV
                                                                                                                                                                    MD5:187F488E27DB4AF347237FE461A079AD
                                                                                                                                                                    SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                                                                                                                                                                    SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                                                                                                                                                                    SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:[ZoneTransfer]....ZoneId=0

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\00c07260dc\explorgu.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\0d798529-90c4-411e-a4cb-e373553d620d.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):828532
                                                                                                                                                                    Entropy (8bit):7.982974072327316
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:J8uKoqVOll80o9nFxcPr+BkJqC3tdSILWyNluz/YFfbzMABinnVQRxjPn8g7lZX1:HKxcl80K2r+ij/CcMnn8j8g7lF1
                                                                                                                                                                    MD5:CB227CF3466A2D2BC80A1767E6977FA5
                                                                                                                                                                    SHA1:1E33069DDB8BF2C09C18B6C1714777E4831BC6C6
                                                                                                                                                                    SHA-256:547F474FD463B4570DC91B7D8581E3D276ABE78ED5B8D242D75373DD78C38411
                                                                                                                                                                    SHA-512:4DB10C25FA29B7D10088D8634CF662BAD3AC66046D1EC3F78F7CEF6DD28AF3ACB9614B73D7DBF36A0B8140F8E45BE84EC71B1313BB6D1FC14114218C4F67EDB6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000019060000670f0000f70f0000ca100000fb1b0000132b00002b2c0000182d00001f2e00006e470000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................r<R1..<.'.qTb..<P..K.PO,:.......JF......h.. .....JX.$pP7......hf... $.)kG_]c.B.4......&tN%. ....Z......K..A.A.t.[.1..q...(..nT.m-.V.?5[..9...>...$....(.%o1."..wc..JF..Y.2...t.'-..7U..Q..X.F.E.....<?D...).t.w.2.......D..u.i............7.F?........;.>...$k...X...`...Y..6.T.Fr..#N".q.I.p......y.e/ku=c..cC..Z{.K...+..#.i.[...+...8.K.d..V.By\.k}...O#7.mj%j.o..;.8.df.D..k....X..sJ{1.....8.V`.....lz...?.xy.....*..Yp]..^x...(T....Lvl.....[s..!cY..@.....3..n\.w.U..c.'..c{.#!"...P..:...{...g...\....-..E.AQ...?~.;.t.}.z-4.[o<..v.....;.....wY....Yp......;"z..z&c..k"L..U...

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\0d9ea59c-5762-40cc-8497-9802416f932b.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:Google Chrome extension, version 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):98996
                                                                                                                                                                    Entropy (8bit):7.702003651641397
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:+cQXinoKQoMGurcwFy3iTpv6zM39m3FPS:+cEUoKnfLvCCzM39m3FPS
                                                                                                                                                                    MD5:34F93FE5B54D7C652360BA28D94F8E66
                                                                                                                                                                    SHA1:31901469EADAD58B8BF99BBD9698E60ACDD7ABED
                                                                                                                                                                    SHA-256:10DC1ED2D8D9D4DB369DDF7FD6F53EFFC9BFD87F46AFDFC6C86CB637D2067A38
                                                                                                                                                                    SHA-512:9B86ACC2F5B92A75BD3028352F03DA10C6424C3514A3372A32EA8F60E79770D8B5AC5DBE0B45DD54B804C6EC79E1A1DBD887D0DF333DD253238DC30E6C5A1000
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Cr24....f"........0.."0...*.H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.q*Ba/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.|.X.M..u..s[.*..?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.*1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........;:[........o$..#Cb.G+.T.hI.9...M.J..u.:....13S..*...%...)Rd.rROmI#z_..sO6@...'/'..... \....5}k..R..2..22..?E.......r;E..Z...C.^.J...=.E.m..hb%{DiYnrD....T.....B.`Z..OCQf...."..P..7.W...D....}.E7P...uf........A.....s.L.!.......!.9..J..c\Ac\5.....[0Y0...*.H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. Z.......o...$k.Sz.i...9D..K.$.. -=C.}.b...P....;.._"...u..s2#..c".>...........|[..:.._...9...O2o.A`.D......D....4..t...euGOL..~...:.:....^...?..C6...8.....?~..M............?..c#.R.........SyU.R..7..L...6r.mk.U.u....X..Wa.o...".o..l...(.5.....t..o......Y..1Q...me....K.....{.~N=8_.:."G.....qq5...^.~....s'.4...re.

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\16753093-eed8-4802-acb3-47beb22894ed.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):206855
                                                                                                                                                                    Entropy (8bit):7.983996634657522
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:5WcDW3D2an0GM0GqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEIO:l81Ltl7E6lEMVo/S01fDpWmEgs
                                                                                                                                                                    MD5:FE412FA3A2B510A55FE8496C5490BB2F
                                                                                                                                                                    SHA1:499667BC9FE43344D037FB95A6563AD30D3DB3D5
                                                                                                                                                                    SHA-256:DE6110AFBA31DC638DE84FD6D255D78C2125CEFADCE3774B310149B4EBE5EE1D
                                                                                                                                                                    SHA-512:3E8821A1249AA4DC88629C9D6BF6BAD0AE9074CFCACB22B3E856F05DB9DCB54A5B4A3F03D9BE94F06C79F28313C95F5E77A66543ADA180ACBE71BC824AEB47B5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......Exif..II*.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..*B.P..*(.................*.....................( ..................*.. .".... .".......(.. .".....*.. ....o......E.6... ..*..."........."J......Ah......@.@@....:@{6..wCp..3...((.(......................*...@..(...."....................*......*.. ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\17ca9414-e798-4cbd-bea6-25af6763d89d.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):510224
                                                                                                                                                                    Entropy (8bit):7.998443444356349
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:12288:XxzqpC6K9mnbVhXKHgwCC9yWol5jbHLhEoXAqDyaDIx5f:Xxz/6cmnbVhXAgwCYolvXAqDTDIx5f
                                                                                                                                                                    MD5:3B2D0A45D7E2C53F14D8E12352CC484B
                                                                                                                                                                    SHA1:D80CF8A840DE8FC9D97B50F1EE8BD684AC428D72
                                                                                                                                                                    SHA-256:32EBA3911185CB2D21118BB46C4A75AD4332C4B657E7083B91FC2164E1EB0B9E
                                                                                                                                                                    SHA-512:5CFE850DE9041E9F92DCAAB95A7286C5CD211E001D5CDF78E0FA2AEBB2539B73C297059504201C7F3DBF7867AFFF047CEB285A65CB9EB3CB84AA9F3E65FDEF64
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:RIFFL...WEBPVP8 @.......*....>Q$.E..!(..y....gAK.\.2't...#.`U........-.o..G..?...o.\l.6..H.~K.l..2...|.?`=r...o..7........LNBO\..<O...=.K.............~.......?.?G.........?0..zo.7..P.........'.q......O...`.f..........LO...............,~....L.E...K..........+.........|..,......._.......S...G...g..............o...?....S...o....m....=.._?.~..-...!..o..Sbo....g...t..j.P..xp1.R.k.[...#...w*.DO..F.T./...{.....%..{I~..MW;..).n.00g.-p.'..E.ZP@6..D6.....~......J...T=:.B <.]t...v^.,.(&...{U...f:.%..Sa..W..,\......|.8...Pc...b...d..v.`#9.C.......}..C..P>...A..K.y,.. P....<..(.T....>/{.@.z..[......w...".....q_K.G/.0`...w....y.L.5..y.r...*v..Do<F..O|...&4..)Vx....o..i...7..:.{...m4.j.u..3..Y.4..VV.2.....[utA..77W..^HO..A.!"|..........hARg.....#.4.m........)..]:t_.{.a.^%..g....J.&.....9..Q.t.6m<.Cr'o.].k..n.P".*.....k..u.v...:.{?.._x....~....1.G..#...~....e...Z.e.Wu<....%..$?6..lsV.4VXR.y...Zrj.. j..I.Ij.?..).y.G...Lw"1OE..n.....!^....X..........|..

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\596ad7b9-999c-453b-b2df-83f467167668.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:Google Chrome extension, version 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):11185
                                                                                                                                                                    Entropy (8bit):7.951995436832936
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
                                                                                                                                                                    MD5:78E47DDA17341BED7BE45DCCFD89AC87
                                                                                                                                                                    SHA1:1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
                                                                                                                                                                    SHA-256:67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
                                                                                                                                                                    SHA-512:9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Cr24..............0.."0...*.H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0...*.H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\5QtvYXoJaghghg50zGLKyNk.zip

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3145
                                                                                                                                                                    Entropy (8bit):7.759892479665945
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:/dGJ0ipQseIsMkxyoyDOQjelJzbcnJ3KJ2NL:/dGJ0WQseIB9CQjmxcnJ6J2NL
                                                                                                                                                                    MD5:6CBF69850CC6BB96471F5E2123713673
                                                                                                                                                                    SHA1:7FD3173DE9E9B248F2677AB21F09830EEB507398
                                                                                                                                                                    SHA-256:81BBE3FD4F8B3095A105095E4C663ED72E5F0E5B035AA6C2C6E9377A4C99D599
                                                                                                                                                                    SHA-512:5BFB1849AA902E6171AE353501FE19A6DC657C18EBC566682349706C5F8CB24B396EFCD7130F99EF2454A2E3E9AB5BCEB0F7308BAC1B610738FE8C8986B95B7D
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\5QtvYXoJaghghg50zGLKyNk.zip, Author: Joe Security
                                                                                                                                                                    Preview:PK..........LX................Cookies\..PK..........LX."0~............Cookies\Chrome_Default.txt...n.@...3..#...6.9.....v...e0.f.c...oU.R{..<.u.uE.....~.V.s...H...BP...p.{4U..m. ..x...:....I.....U.a..PQ[..Z.N|=u...R....DoG0...}..p....M..:]J.......b...v....?.?...-/.P......?...a..c.2.5c.7.E][..b|.....9qW..m....!l....,.tXB........k..,.v-K.s.1N.......k&....b.._S7x..M...v...9X.wL../.,...aeD...X_-..Q........-..$.|..=.....F..z)..6]j.E....d.....6..E.GzC..*.....v`...Y8.....PK..........LXZ.l.............information.txtuY[o.H.~G.?../..S..y..$...&$i.$..1..4.m.2...s...(.E..;.S.bW...b.'U\V...-.4.......v>..a.._.0N8./.|.3...4...$.L.z..qO.N{.d:.)A...f2...|.y.....!iO.$.1fm/LX....z......v....qdCj..L"K.L.Z..X.0.Skk?Gq..'.....E.......rt...........7.)-...."~~YOlQ=..V..m...{.\=..|b.........v=...~....vj..I.....Z.Y...4..oe.l?.F.xH.6Z.........../!.<.Q...-...sH.."~'w...kg..n.....m......m..\u;7.}...tO._..."-_..,....|./?..Q..pA...)....0\W....vj..y...A...+0......

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\5d094c2e-0112-4732-a4da-6351b19bbc0a.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3447863
                                                                                                                                                                    Entropy (8bit):7.9981793200918965
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:98304:Ah2vbLr+zXqtjXzZI23aoef3WQw41AV4Owou0gyN9CsvsFayPdo:Ah2TLrgOjDO2FefRx1Abu0nQsvlyPO
                                                                                                                                                                    MD5:56BEC678D03ABFD545A52D6B9CA15843
                                                                                                                                                                    SHA1:45B16A2538D881A592BFB72DAB530E1FF6CA2090
                                                                                                                                                                    SHA-256:D93CC299D89D02C3F421778C91092C7F6DD7895268C05D6C4E8592BDA3160D3E
                                                                                                                                                                    SHA-512:180A504CFD501061B2CB8574C89AF0F4B03706A1A5B3B5106F2A2572CBE0972AE17944CB615F68B4E313C6991CE610348B7E5CB92DDD299A679040B65546A2A6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:RIFF>...WEBPVP8 2...pR...*....>Q$.E..%!%..h...cm....~7S.l...s....+.w.o....t.......+...Z...rP.1.O`..S..........L.c..^.w....Q.g....G{..O......;....>s./................y...C..C..?...?f}..~........_...?l.Y.........t.!............K._r.I....~m|?....}..}.W...w.*.....C.:.....?.Ws...;.;.....!...A...?.z........?......?...'...~.|..6..........._.....................:...k.o....s......?`?..Q.29.Y.....b.=..{.......$..2..x.N*X...f...Z....w..U...z.9S.1-.-..:b'............>.....!.....r.Lh/....u..q..GG....F.....on...e....u.&S.H..}.E.9.l..'.k....Y>..........!b@.....KF.,/l..3:.....Q..f.e..?..Jl3.?..z..o....qV...i.$x...v..$...e..[..0.N......Ms.Y...?...u......o..Q2..b...........W.|h...&E...4....H.T'.W.M...(.......D..w.}.HlA.]....T9....@.i\^......j<$.$.@co.A...Z.hT..^.9,....}j+x"..#A.......)f...Q.85........u..6.......D."..v..7!G..A.7..._..k.)Ji..skP..c.j.9.dpI..L..s..M.I..6.'M.....|w.5.{?N..:)..'...Wh...........I.....p/..e~....*...J.=..c..b....F.0H.c

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\EdgeMS131\EdgeMS131.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\P52521B9kqdb74d8LejmrZT.zip

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4173
                                                                                                                                                                    Entropy (8bit):7.811300922723337
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:hdGJ0ipQoxdAfwTLO/SxLAr42IJ6YNXf7bZ1Mw3KJEJ:hdGJ0WQ2DTL4r4tJ6KJ6JEJ
                                                                                                                                                                    MD5:AE271EB5F94C7711E2D84382410666AA
                                                                                                                                                                    SHA1:16BCFFE4DDED602B231EFE5F3FDFD0C8A0740CF5
                                                                                                                                                                    SHA-256:68758546D2BDF1B462C382571F7BB4D2C8028E8C878E6FC777129D841BC11FB8
                                                                                                                                                                    SHA-512:50C784127035B785FE3DAF0ED3A534A6BD88A30245FB69D3F223E03A605E26D28D96CDD4ADD9ABF8450CE8F074FCD6B40894A75D563172DD577122554F1E0271
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\P52521B9kqdb74d8LejmrZT.zip, Author: Joe Security
                                                                                                                                                                    Preview:PK........7.LX................Cookies\..PK........7.LX."0~............Cookies\Chrome_Default.txt...n.@...3..#...6.9.....v...e0.f.c...oU.R{..<.u.uE.....~.V.s...H...BP...p.{4U..m. ..x...:....I.....U.a..PQ[..Z.N|=u...R....DoG0...}..p....M..:]J.......b...v....?.?...-/.P......?...a..c.2.5c.7.E][..b|.....9qW..m....!l....,.tXB........k..,.v-K.s.1N.......k&....b.._S7x..M...v...9X.wL../.,...aeD...X_-..Q........-..$.|..=.....F..z)..6]j.E....d.....6..E.GzC..*.....v`...Y8.....PK........7.LX..@L...........Cookies\Edge_Default.txt....X....#.....9..`v.}3&..a.,.,6<}_M4.M.......c..iF.G.;..=i..|7.v...`..1;.2=..%S....o.i-=..q3.q....~...-._._.-...3.......9.'.%...cU.Sj..a.k.....W....U.......".r...`.iu..N%3.!F...@.W.L.^#|..q..f8`.N'".-st..7z^.hW,..@.........UWs..w...`e.L0."..|0..yL.S.L....>.nS_...F.../......d.:=J..A...M...X.T.[.....>...?..e...v..e.O.....[...4.[W~1...:..p:vad.......?.I1.p....F..2U..t...%..).Q..(,.G..c.Q'oW.............o..;\....".30..x.a..}..n

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobe2JNoqCa0s9_1\Cookies\Chrome_Default.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):530
                                                                                                                                                                    Entropy (8bit):5.958474698481357
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:copYxlijbcjkI7F5jiFZYs38lqOIkvurL9ctmcjO:Klwbcjk+JsZylqOhWBckcjO
                                                                                                                                                                    MD5:502EDC3147DEA56D074B4453CE6EF23E
                                                                                                                                                                    SHA1:A56E3680E6D7A09A694F1F6B7711BF00CC84E154
                                                                                                                                                                    SHA-256:13DFA1C6672FC5ABDE53C4FAFAA4DBAFB0DC23CE1F88D4264961427311326BEE
                                                                                                                                                                    SHA-512:203C07C84BA88C8D92B1F9E517F1556537E6273A7E944BD048313F381D64FAE8B83738CEC02843A2DDF01CAE1D40FD282E81AC1D28B637F4E9A90C5F53189CA6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.google.com.FALSE./.TRUE.1699085938.1P_JAR.ENC893*_djEwLavoQSuZmnbgKC0V9kjHN9bHA9ngJdqAkvOVhaomzcxtYYMxx8ANM/U=_/uMNoER/9pD2h3Kq19wy5TOobYwsP/SldTt3n0celPM=*...google.com.TRUE./.TRUE.1712305138.NID.ENC893*_djEwHTM2wfKV2YxQ9mvStmVLYPN4tZgfHWg+jkSVyZP+e7Oi7/DEt1XTnmNp3N0jjxwXzTOL5u3C/EfCucCDqjRUL/nonxZ0syyCCZvw0BH6CyCOtDJx/7nMgo8JH41lYPSsbzi2lM9kBLMDeySzGBx45nrC8zUE0MX+HUc1Q5CE+zgCCUUV9lQSeyP4OMUzP2x44dh2ptxvH8RYkyxvRqrAQbY0zDwflQLV32L/WiZ6CMDtSY0mjJDUPIbi9c1P8lGXoRlnuxakxYy2a0c=_/uMNoER/9pD2h3Kq19wy5TOobYwsP/SldTt3n0celPM=*..

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobe2JNoqCa0s9_1\information.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):6905
                                                                                                                                                                    Entropy (8bit):5.2969328902600195
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:x9w7kRdCcnExrvoENAa9DrJbXNo/FMIkXETz3blhoANUbg3x:x1rCgOrvoENAapB6pk6/ZB
                                                                                                                                                                    MD5:63F8AF864CF101F6B5D6FB676D0FB7DA
                                                                                                                                                                    SHA1:FA0194641A4B12C530BE0C3B7087A8D93721DCFD
                                                                                                                                                                    SHA-256:B36436F099286D5287CBE6459F382E3F81605C10CF39763530CD465E4B06BF01
                                                                                                                                                                    SHA-512:A586E9408EA7AF7E753FF957E5F56B56E47FE2F2382316D25DA4387FF2C04DDEEDDE5413770D85E6CC953FB939E79CABFE372C23B0803FC779E9B710E7419A33
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Build: tasty..Version: 1.5....Date: Mon Feb 12 20:39:47 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: a9e80ec1cb9e00f3a50e294a5e89edee....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobe2JNoqCa0s9_1....IP: 81.181.57.74..Location: US, Atlanta..Windows: Windows 10 Pro [x64]..Computer Name: 284992..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 12/2/2024 20:40:3..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [556]..services.exe [624]..lsass.exe [640]..svchost.exe [744]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..svchost.exe [868]..svchost.ex

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobe2JNoqCa0s9_1\passwords.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4897
                                                                                                                                                                    Entropy (8bit):2.518316437186352
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                    MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                    SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                    SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                    SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobe3rWvK1xaZKPt\Cookies\Chrome_Default.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):530
                                                                                                                                                                    Entropy (8bit):5.958474698481357
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:copYxlijbcjkI7F5jiFZYs38lqOIkvurL9ctmcjO:Klwbcjk+JsZylqOhWBckcjO
                                                                                                                                                                    MD5:502EDC3147DEA56D074B4453CE6EF23E
                                                                                                                                                                    SHA1:A56E3680E6D7A09A694F1F6B7711BF00CC84E154
                                                                                                                                                                    SHA-256:13DFA1C6672FC5ABDE53C4FAFAA4DBAFB0DC23CE1F88D4264961427311326BEE
                                                                                                                                                                    SHA-512:203C07C84BA88C8D92B1F9E517F1556537E6273A7E944BD048313F381D64FAE8B83738CEC02843A2DDF01CAE1D40FD282E81AC1D28B637F4E9A90C5F53189CA6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.google.com.FALSE./.TRUE.1699085938.1P_JAR.ENC893*_djEwLavoQSuZmnbgKC0V9kjHN9bHA9ngJdqAkvOVhaomzcxtYYMxx8ANM/U=_/uMNoER/9pD2h3Kq19wy5TOobYwsP/SldTt3n0celPM=*...google.com.TRUE./.TRUE.1712305138.NID.ENC893*_djEwHTM2wfKV2YxQ9mvStmVLYPN4tZgfHWg+jkSVyZP+e7Oi7/DEt1XTnmNp3N0jjxwXzTOL5u3C/EfCucCDqjRUL/nonxZ0syyCCZvw0BH6CyCOtDJx/7nMgo8JH41lYPSsbzi2lM9kBLMDeySzGBx45nrC8zUE0MX+HUc1Q5CE+zgCCUUV9lQSeyP4OMUzP2x44dh2ptxvH8RYkyxvRqrAQbY0zDwflQLV32L/WiZ6CMDtSY0mjJDUPIbi9c1P8lGXoRlnuxakxYy2a0c=_/uMNoER/9pD2h3Kq19wy5TOobYwsP/SldTt3n0celPM=*..

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobe3rWvK1xaZKPt\information.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5913
                                                                                                                                                                    Entropy (8bit):5.298208534516307
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:x9hjYkRdTcnExrvoENAnCqrJbXNo/FdANUbg3x:xjhrTgOrvoENAnCqB6sB
                                                                                                                                                                    MD5:7944B604556A0AFBA4F7C9D7B4C090E4
                                                                                                                                                                    SHA1:15FC5D9BE17BCFCEA872C6F07E9F45156A8F3FD4
                                                                                                                                                                    SHA-256:6A76CBC47D062143EF2974C3488BD766F7AEF3DA85D0D3996B4A4FD4F854E6FD
                                                                                                                                                                    SHA-512:FBDF957A0B1DCC2F1479842B9F98B0A1A32277A0CCB9F6B50C902D9BAFEFEEFB561A17BFFFEF596D6AE25D6A555F4251991FD4856E98D1AB6F72E11883952468
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Build: tasty..Version: 1.5....Date: Mon Feb 12 20:39:31 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: a9e80ec1cb9e00f3a50e294a5e89edee....Path: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobe3rWvK1xaZKPt....IP: 81.181.57.74..Location: US, Atlanta..Windows: Windows 10 Pro [x64]..Computer Name: 284992..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 12/2/2024 20:39:31..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [556]..services.exe [624]..lsass.exe [640]..svchost.exe [744]..fontdrvhost.exe [776]..fontdrvhos

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobe3rWvK1xaZKPt\passwords.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4897
                                                                                                                                                                    Entropy (8bit):2.518316437186352
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                    MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                    SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                    SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                    SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobeOZ8O8BClDfN5\Cookies\Chrome_Default.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):530
                                                                                                                                                                    Entropy (8bit):5.958474698481357
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:copYxlijbcjkI7F5jiFZYs38lqOIkvurL9ctmcjO:Klwbcjk+JsZylqOhWBckcjO
                                                                                                                                                                    MD5:502EDC3147DEA56D074B4453CE6EF23E
                                                                                                                                                                    SHA1:A56E3680E6D7A09A694F1F6B7711BF00CC84E154
                                                                                                                                                                    SHA-256:13DFA1C6672FC5ABDE53C4FAFAA4DBAFB0DC23CE1F88D4264961427311326BEE
                                                                                                                                                                    SHA-512:203C07C84BA88C8D92B1F9E517F1556537E6273A7E944BD048313F381D64FAE8B83738CEC02843A2DDF01CAE1D40FD282E81AC1D28B637F4E9A90C5F53189CA6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.google.com.FALSE./.TRUE.1699085938.1P_JAR.ENC893*_djEwLavoQSuZmnbgKC0V9kjHN9bHA9ngJdqAkvOVhaomzcxtYYMxx8ANM/U=_/uMNoER/9pD2h3Kq19wy5TOobYwsP/SldTt3n0celPM=*...google.com.TRUE./.TRUE.1712305138.NID.ENC893*_djEwHTM2wfKV2YxQ9mvStmVLYPN4tZgfHWg+jkSVyZP+e7Oi7/DEt1XTnmNp3N0jjxwXzTOL5u3C/EfCucCDqjRUL/nonxZ0syyCCZvw0BH6CyCOtDJx/7nMgo8JH41lYPSsbzi2lM9kBLMDeySzGBx45nrC8zUE0MX+HUc1Q5CE+zgCCUUV9lQSeyP4OMUzP2x44dh2ptxvH8RYkyxvRqrAQbY0zDwflQLV32L/WiZ6CMDtSY0mjJDUPIbi9c1P8lGXoRlnuxakxYy2a0c=_/uMNoER/9pD2h3Kq19wy5TOobYwsP/SldTt3n0celPM=*..

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobeOZ8O8BClDfN5\Cookies\Edge_Default.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (369), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1536
                                                                                                                                                                    Entropy (8bit):6.003397743021211
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:v6e6e8CGWHHkG6lTiW+tX6l+yXpY1eLjbBbnNnssholT6eRUyLJSlTi+z8u1lTiH:v6Jg9Eh1UtX6l5Y1eLdn9sV16OUgS1Zi
                                                                                                                                                                    MD5:72C8FB10ABEB024E5DF64952ECE823C9
                                                                                                                                                                    SHA1:4FB1AAC8F9CDB03B479595E04AA58981A3FA05B2
                                                                                                                                                                    SHA-256:13AA8EDF9B51270B1C2E708DCF016AE695CE60A9FE8D66C14A98DF62217810FB
                                                                                                                                                                    SHA-512:D08EBAB265C25789B66799F40E1A8B3E6718508456F081432FF23D930D17EC2BDF749C970746BDDA180303F1A469A5A91FAD78DC1DABC24D5A84F5816BD53E7F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.youtube.com.FALSE./.TRUE.1707767395.CONSISTENCY.ENC893*_djEw1vNZ0NdT0H9ZQB0WsTn6h1TE0xRkcnrNQugM6cfAWh49PT10vXpFfryH6KdNRMByfjS44dV2zRxVRMZTziRTo40FbW1bEXRYpqJY7MFGNOnbiiKh5tjV/3jdWMb99gKNPPyX0y8dJySQlqB/yybKK1cDONsQtkSsSSicIa/e4sU1bFTdbgPpT37UWS3jiujoLpb6ZQIc/howc/GO1qdhr5q1SS5i8d6W1uj+BmrinzHxC7A=_X5LHVxTt8Tvn7RN6ijdJExZQburb6ljnPXsi7bhmzUw=*...youtube.com.TRUE./.TRUE.1707768587.GPS.ENC893*_djEwothyxqhz6sm0SS2deZmRFx532ejzHqC/CKJnVXM=_X5LHVxTt8Tvn7RN6ijdJExZQburb6ljnPXsi7bhmzUw=*...google.com.TRUE./.TRUE.1723577998.NID.ENC893*_djEwasF3hPkt2QWFvLqh/n6X2FFb5H705G63AX/Of/MJL2kaRgCEaTngRL5Nt+098LI1tTPUYPVvBVG66gGEWe7qNispL8ZeHoUeBklBHu/gl9t87sSB2Lu8PP4p8MPPN2IQdsTAbJ9US7mKfNe4u50+9EZQMDUIJWuOadeVnMyItGmuDUlq2NrkL9lqFuOpbC7vylcdgkqJjDhcQ8hmEzGy/DOqD75wpjFEyP0xzb2Gavdqe4ZA85hZQln8/97ZCvuvObfBBSE3d24mXmg=_X5LHVxTt8Tvn7RN6ijdJExZQburb6ljnPXsi7bhmzUw=*...youtube.com.FALSE./.TRUE.1742326800.PREF.ENC893*_djEwoTjr+jKqssl8P6RxnD3aK8dhUqfQzECa6W1y98jLF8EbMKeFfvvIaiZ20Co=_X5LHVxTt8Tvn7RN6ijdJExZQb

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobeOZ8O8BClDfN5\information.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):7485
                                                                                                                                                                    Entropy (8bit):5.247430632770188
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:x9AHkRdIcnExrvoENmBrJbXNoDxIDz/bNfV/ANUbg3x:x9rIgOrvoENmBBjnBVkB
                                                                                                                                                                    MD5:A9C544A85CF8C755607C52AFAB0DE578
                                                                                                                                                                    SHA1:CF27DAFC845F662AA00448267C7D071AC0C513D0
                                                                                                                                                                    SHA-256:5DD923E0D12863B04AA97688604B4DDC80753EB883502E16232374943CFA0D98
                                                                                                                                                                    SHA-512:394084598B3BB0B27DB723D2C8D00C9E2D0710845FB1D9332BACFF1A412F60B306B879C4FBA8FECB8D2B1D2016F7A1B6C061FB6387B46898D0622776DF1A4F2A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Build: tasty..Version: 1.5....Date: Mon Feb 12 20:41:40 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: a9e80ec1cb9e00f3a50e294a5e89edee....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\adobeOZ8O8BClDfN5....IP: 81.181.57.74..Location: US, Atlanta..Windows: Windows 10 Pro [x64]..Computer Name: 284992..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 12/2/2024 20:41:44..TimeZone: UTC1....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [556]..services.exe [624]..lsass.exe [640]..svchost.exe [744]..fontdrvhost.exe [776]..fontdrvhost.exe [784]..svchost.exe [868]..svchost.e

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\adobeOZ8O8BClDfN5\passwords.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with CRLF, LF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4897
                                                                                                                                                                    Entropy (8bit):2.518316437186352
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
                                                                                                                                                                    MD5:B3E9D0E1B8207AA74CB8812BAAF52EAE
                                                                                                                                                                    SHA1:A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
                                                                                                                                                                    SHA-256:4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
                                                                                                                                                                    SHA-512:B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\b21def9c-1665-4140-b0c9-222c3bc24dbf.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):165310
                                                                                                                                                                    Entropy (8bit):7.935226537725646
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:wWfwiOPO+EuNxBKTyPCgXfDfBt6T4/W4ZcSNTU:UBnEuDBKTYCgfdy4/W4Z0
                                                                                                                                                                    MD5:1A5CA1695AE4C2C7A7E74A6CB7F42A11
                                                                                                                                                                    SHA1:3FE4EF122C0DACA0D8C25B79ADC6EF9D8481FC65
                                                                                                                                                                    SHA-256:AD86351CBF780F8239DF8F90740888B2BDB7E99D9D18D383F7FC785821CBBE01
                                                                                                                                                                    SHA-512:375624FCEA20F361E018C85DACD15D6AD2F1996347665AB9FA5B70BA8681988A20DA0C1FA11BC6F60B013B462F597C0066E039D620A524D0A2FA08B3BA08DF24
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000019060000670f0000f70f0000ca100000fb1b0000132b00002b2c0000182d00001f2e00006e470000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................r<R1..<.'.qTb..<P..K.PO,:.......JF......h.. .....JX.$pP7......hf... $.)kG_]c.B.4......&tN%. ....Z......K..A.A.t.[.1..q...(..nT.m-.V.?5[..9...>...$....(.%o1."..wc..JF..Y.2...t.'-..7U..Q..X.F.E.....<?D...).t.w.2.......D..u.i............7.F?........;.>...$k...X...`...Y..6.T.Fr..#N".q.I.p......y.e/ku=c..cC..Z{.K...+..#.i.[...+...8.K.d..V.By\.k}...O#7.mj%j.o..;.8.df.D..k....X..sJ{1.....8.V`.....lz...?.xy.....*..Yp]..^x...(T....Lvl.....[s..!cY..@.....3..n\.w.U..c.'..c{.#!"...P..:...{...g...\....-..E.AQ...?~.;.t.}.z-4.[o<..v.....;.....wY....Yp......;"z..z&c..k"L..U...

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\b857180f-2e62-4f24-8979-be8b51c25023.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):76326
                                                                                                                                                                    Entropy (8bit):7.9961120748813075
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
                                                                                                                                                                    MD5:01E352D35675990A139199DD86B38AAC
                                                                                                                                                                    SHA1:E16163C81E5F36B3B819AA0A63BFA63D88548A91
                                                                                                                                                                    SHA-256:148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
                                                                                                                                                                    SHA-512:75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:...........m{..(.}...7.\...N.D*.w..m..q....%XfL.*I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'.*.."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g.*.^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\bc9e3268-bcc5-4048-8c0c-97cdfb1ed5dd.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):265868
                                                                                                                                                                    Entropy (8bit):7.99673494574561
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:6144:DZRlDzIDF09eIns3XnH+4BwYsbCc7BtRKxz:zpz+3XnPs3BtRKxz
                                                                                                                                                                    MD5:F774D84CF529D8E6763010FD7B8613BC
                                                                                                                                                                    SHA1:C08B798F94F75C60A7B492F0444CA0F95E7A8033
                                                                                                                                                                    SHA-256:1B88358FAB68D993C2E54DB9F3117DE8715CF9E544D070F69C6F575A22451D0D
                                                                                                                                                                    SHA-512:EAF4EA44413431922121615D5757886C275B628CCF3AE54F2C37C6D78C5C799A7D0E7A4D4F4A1DA0CD61A6F9FBE3B94E2B5B5D2BE66F78CC5226706A2365146A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:......JFIF......................................................................................................................................................D.D...........................................5............................!"1..Q.$24Au.q.#RUa.....................................?.........................!1.AQ.."2a.#q.46s..Bbr.....RS...................?....+...).).).).).).).).*.:..........I.9...2.>._8.$..Q..v..p...K.e!_. .$..Ru..l.7...!I...:|...*?.......j...........e_..F......./...k...U.B..........>.J..c._.......+..E....\.ZR......P..n.iN.I.$.3.}.6.......QP...........r...l...m.=<..Q......Y.....F..L.1...^.a....%Jl....w.v.......H.U.....,....N.c.Xz...H......aa.uvY.v@Pp.|S.B.....j..0.lr..!S.Q...{.......e.n..%....N.~..o.9R....|...x.T.vOd.t.}..JGx.8..R.>...7.....$gX...{.j..w..s...$.].N..Y......%.BI...t..RG#Z......zq&.A|..I,.p.......c.Gfs.Q..9d.2VV....lQ...L...g^.....I.m.1a.wB..QJ..J....@.d..t.......m......c*y!..v.....,+..8...E.^*.C.p...F@@..._.f.O8..

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\cv_debug.log

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1182
                                                                                                                                                                    Entropy (8bit):5.378327131786551
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:YJxF5sQ5szAW01Rp5yK10YO5qv70VhQu5Fa0l5v5M:YJxF5sQ5sEW01X5y60YO5qD0VH5Fa0lo
                                                                                                                                                                    MD5:9C7FF9AF76E1D6579F1EC7CE901B3BBD
                                                                                                                                                                    SHA1:7B18058F76E00A7D1942DE8C15C6633491F5468E
                                                                                                                                                                    SHA-256:FA30086C972F761FF5C7FAFFA3A9878EE407F52CC77783459333DFA9EB953E42
                                                                                                                                                                    SHA-512:80131BFF19C45E6F951A8266B6ED8BB8197218B4273B9B26D0E51B5A690218B23E722871F6EECA81EBF47E6D384BC9F308CB2F5E19E14B22B9561E1956697A58
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"logTime": "1005/081724", "correlationVector":"2/PmMr7SOFFRIqTwW+HesJ","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"mBsci4p0IuAlecFQAh3IDU","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/081729", "correlationVector":"EFCCE5F7ECC74238A0D17C500D8EB81C","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083130", "correlationVector":"jkXXrPbML/1ucIa5c7okZ6","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083130", "correlationVector":"CECEB17551BE48CCBF3DD12E07118D84","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083241", "correlationVector":"WUtA7xoJfeUJPFSRRtPAng","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083242", "correlationVector":"B7F67C44DD3147F7BE748158D3F8E7B5","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/083444", "correlationVector":"6kKZpL8SvSsrBcj/Fl+tva","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/083445", "correlationVector":"94D95442

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\02zdBXl47cvzHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):159744
                                                                                                                                                                    Entropy (8bit):0.5394293526345721
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                    MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                    SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                    SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                    SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):98304
                                                                                                                                                                    Entropy (8bit):0.08235737944063153
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                    MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                    SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                    SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                    SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\2jQJv37iJ0lzCookies

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):0.6732424250451717
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                    MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                    SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                    SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                    SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5242880
                                                                                                                                                                    Entropy (8bit):0.03708713717387235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
                                                                                                                                                                    MD5:85D6E1D7F82C11DAC40C95C06B7B5DC5
                                                                                                                                                                    SHA1:96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
                                                                                                                                                                    SHA-256:D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
                                                                                                                                                                    SHA-512:5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\6EzL3hHTS7jbM2Oz3y4V.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):917504
                                                                                                                                                                    Entropy (8bit):6.5796923326287295
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaWTO:FqDEvCTbMWu7rQYlBQcBiT6rprG8auO
                                                                                                                                                                    MD5:67B659FCDDF2F8C738A12D6E482A076B
                                                                                                                                                                    SHA1:55770081B3C041F8CD03EE37642EDBA2579577F5
                                                                                                                                                                    SHA-256:69B8854E797EFA1FF495D96F6478162F4292C2CAF180EA4438DFBA8677D0930A
                                                                                                                                                                    SHA-512:90D46A119F640E71E1D18F5DD448A5742AAEACFADC91E4232BDC40CBC752311CDC68968AFE0C8C7FC9F47A63D974405371E58E9F9FACD00DBBC031DE83680AB4
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i.e.........."..........P......w.............@..........................`......8.....@...@.......@.....................d...|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\7roqVJbvngCJVdY0TyvA.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\8PXzAAoEBuHCTzP4RBWU.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3100160
                                                                                                                                                                    Entropy (8bit):7.975874249443056
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:gS9FJHxNhIc1HqApr8PK1ui4B3qRkFgjFCPQwpjuS+BWtB8xg9NMMIRwm:gS9FpxNCcMAGP6U0kFgov1+Rxg9aAm
                                                                                                                                                                    MD5:E2467950D27C4297353607B662102098
                                                                                                                                                                    SHA1:BC041DA517F37EDD108DD9E7E4E5AC1A15990591
                                                                                                                                                                    SHA-256:AC7B729CDC37128C14D5897A4BFB7AE4DB1E18373C283199331B72D6B4AAA09E
                                                                                                                                                                    SHA-512:16306B7B922B618814E2372160553C544B461B92E5ABF4AA60C3A845DDAFA02AF5387849FC9E63739CEC9A14088499547ED95C2BADE9E3956BDD3DC60EECD978
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....>....................@.......................................@... .. .... .. .......... ...:...\...x....................................................................................................................................8..................@............p......."...<..............@............@...0.......^..............@................p.......f..............@....................d...f..............@....rsrc...............................@..@.........Py.. ...(..................@....data....P"..p...N".................@...................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                    Entropy (8bit):0.8553638852307782
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                    MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                    SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                    SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                    SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\AqC0xzKsd_7euDTV6SA_.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1755648
                                                                                                                                                                    Entropy (8bit):7.944092570478896
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:XMp5Tjy4W4TOoWyaUeEetFfU3LhXaYLJnxpMYwP2RCspkBRzWhy3TEcO2:664TOo6tFWLxfZQ6CokjWh5
                                                                                                                                                                    MD5:64D74B4DCF40E24D3F163421AD180350
                                                                                                                                                                    SHA1:EE884429F86E6A694E4867D46EDF93307637EE93
                                                                                                                                                                    SHA-256:EBE7EB37705A453FE43B000BB31638040864F7AFCEC0161157EE0C78E0738CE1
                                                                                                                                                                    SHA-512:DF39465AD54A006C45DC5EFDC6E2494148C24394BF4671D7F6147B4F775F6C0AFABA6C189547ABC8A6462B6175734291A98E1EC96A5E75C97920563606C3FA4A
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............F.. ...`....@.. ....................... F...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...edffsevf.....`+......:..............@...xbfgsjgd. ....F.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\D87fZN3R3jFeWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5242880
                                                                                                                                                                    Entropy (8bit):0.03708713717387235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
                                                                                                                                                                    MD5:85D6E1D7F82C11DAC40C95C06B7B5DC5
                                                                                                                                                                    SHA1:96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
                                                                                                                                                                    SHA-256:D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
                                                                                                                                                                    SHA-512:5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                    Entropy (8bit):0.8553638852307782
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                    MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                    SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                    SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                    SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\IWPfiAXUTJTSHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):159744
                                                                                                                                                                    Entropy (8bit):0.5394293526345721
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                    MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                    SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                    SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                    SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\KvHrxJ77cmUgLogin Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):51200
                                                                                                                                                                    Entropy (8bit):0.8746135976761988
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                    MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                    SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                    SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                    SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\QdX9ITDLyCRBWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\UPG2LoPXwc7OWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.1209886597424439
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                                                                                                                    MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                                                                                                                    SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                                                                                                                    SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                                                                                                                    SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\WWQdc6vczGf1JWs0hh6W.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1166336
                                                                                                                                                                    Entropy (8bit):7.035421328659107
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aHh2+b+HdiJUt:CTvC/MTQYxsWR7aHh2+b+HoJU
                                                                                                                                                                    MD5:FC157BF81AB006D1BB0A542AAF499C53
                                                                                                                                                                    SHA1:2B5F22AC2158A90EAE8783E05E62171095BBDCE7
                                                                                                                                                                    SHA-256:CADCD8C01844EFD569E6D84E5CF516261A8E43450B2B22D8227A710EAA524909
                                                                                                                                                                    SHA-512:723F661B13ED7CC9444BA0C1038B2DB23716BDE32EF02F504131A4F11E5A23A9186EC527C0D9291F18194E7193D62687BE1F2A5385FFA37D3B1EA95AAAC2F8F8
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 35%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...$..e..........".................w.............@..........................0............@...@.......@.....................d...|....@..l`.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...l`...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\ZunTSaNJLBVfWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.1209886597424439
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                                                                                                                    MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                                                                                                                    SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                                                                                                                    SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                                                                                                                    SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\o0qT3dWYBP7ZHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                    Entropy (8bit):0.5407252242845243
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                    MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                    SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                    SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                    SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\oOPEmFmu_xsJCookies

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):0.8475592208333753
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
                                                                                                                                                                    MD5:BE99679A2B018331EACD3A1B680E3757
                                                                                                                                                                    SHA1:6E6732E173C91B0C3287AB4B161FE3676D33449A
                                                                                                                                                                    SHA-256:C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
                                                                                                                                                                    SHA-512:9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\pSE1jchbiT9aHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                    Entropy (8bit):0.5407252242845243
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                    MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                    SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                    SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                    SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\suOrwW4ZcUbjWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.1209886597424439
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                                                                                                                    MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                                                                                                                    SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                                                                                                                    SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                                                                                                                    SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi2JNoqCa0s9_1\zFHlx6IqQx3xR1F02yH2.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2368000
                                                                                                                                                                    Entropy (8bit):7.961235677287098
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:eUyifO8En01EXhKEuytmKpHc0Cy7d+oMaHOjLxdPrtCI:vSxmmhc0D7d19HO9fC
                                                                                                                                                                    MD5:3AD46004D0FBDA320BC0B683582FE08A
                                                                                                                                                                    SHA1:3DD6A47BD2C1BAF1950E0C8B9445DBB331026975
                                                                                                                                                                    SHA-256:3884AC010768A5FB727DE050321C82D99591B8DFD5F82ACA60987B55D343EBFC
                                                                                                                                                                    SHA-512:24C963EF5EC8DDDF25542DDF9D543F398E8D1474649A73AEAAD58033AE358C068B1D9B1E6FA9AF6134052FA2979445B27F104424D415AEB030EB091311E0D21E
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......p[...........@...........................[.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... ..,.........................@...bqhqoftp.....p@.....................@...grvnhumg.....`[.......#.............@....taggant.0...p[.."....$.............@...................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\02zdBXl47cvzHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):159744
                                                                                                                                                                    Entropy (8bit):0.5394293526345721
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                    MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                    SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                    SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                    SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):98304
                                                                                                                                                                    Entropy (8bit):0.08235737944063153
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                    MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                    SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                    SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                    SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\2jQJv37iJ0lzCookies

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):0.6732424250451717
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                                                                                    MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                                                                                    SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                                                                                    SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                                                                                    SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5242880
                                                                                                                                                                    Entropy (8bit):0.03708713717387235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
                                                                                                                                                                    MD5:85D6E1D7F82C11DAC40C95C06B7B5DC5
                                                                                                                                                                    SHA1:96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
                                                                                                                                                                    SHA-256:D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
                                                                                                                                                                    SHA-512:5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\3rOLtV34Ut0fTkzynGHi.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3100160
                                                                                                                                                                    Entropy (8bit):7.975874249443056
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:gS9FJHxNhIc1HqApr8PK1ui4B3qRkFgjFCPQwpjuS+BWtB8xg9NMMIRwm:gS9FpxNCcMAGP6U0kFgov1+Rxg9aAm
                                                                                                                                                                    MD5:E2467950D27C4297353607B662102098
                                                                                                                                                                    SHA1:BC041DA517F37EDD108DD9E7E4E5AC1A15990591
                                                                                                                                                                    SHA-256:AC7B729CDC37128C14D5897A4BFB7AE4DB1E18373C283199331B72D6B4AAA09E
                                                                                                                                                                    SHA-512:16306B7B922B618814E2372160553C544B461B92E5ABF4AA60C3A845DDAFA02AF5387849FC9E63739CEC9A14088499547ED95C2BADE9E3956BDD3DC60EECD978
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....>....................@.......................................@... .. .... .. .......... ...:...\...x....................................................................................................................................8..................@............p......."...<..............@............@...0.......^..............@................p.......f..............@....................d...f..............@....rsrc...............................@..@.........Py.. ...(..................@....data....P"..p...N".................@...................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1755648
                                                                                                                                                                    Entropy (8bit):7.944092570478896
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:XMp5Tjy4W4TOoWyaUeEetFfU3LhXaYLJnxpMYwP2RCspkBRzWhy3TEcO2:664TOo6tFWLxfZQ6CokjWh5
                                                                                                                                                                    MD5:64D74B4DCF40E24D3F163421AD180350
                                                                                                                                                                    SHA1:EE884429F86E6A694E4867D46EDF93307637EE93
                                                                                                                                                                    SHA-256:EBE7EB37705A453FE43B000BB31638040864F7AFCEC0161157EE0C78E0738CE1
                                                                                                                                                                    SHA-512:DF39465AD54A006C45DC5EFDC6E2494148C24394BF4671D7F6147B4F775F6C0AFABA6C189547ABC8A6462B6175734291A98E1EC96A5E75C97920563606C3FA4A
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............F.. ...`....@.. ....................... F...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...edffsevf.....`+......:..............@...xbfgsjgd. ....F.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                    Entropy (8bit):0.8553638852307782
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                    MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                    SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                    SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                    SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\D87fZN3R3jFeWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5242880
                                                                                                                                                                    Entropy (8bit):0.03708713717387235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
                                                                                                                                                                    MD5:85D6E1D7F82C11DAC40C95C06B7B5DC5
                                                                                                                                                                    SHA1:96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
                                                                                                                                                                    SHA-256:D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
                                                                                                                                                                    SHA-512:5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                    Entropy (8bit):0.8553638852307782
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                    MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                    SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                    SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                    SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\IDzOFuKIaHRpmM4TfCyF.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2368000
                                                                                                                                                                    Entropy (8bit):7.961235677287098
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:eUyifO8En01EXhKEuytmKpHc0Cy7d+oMaHOjLxdPrtCI:vSxmmhc0D7d19HO9fC
                                                                                                                                                                    MD5:3AD46004D0FBDA320BC0B683582FE08A
                                                                                                                                                                    SHA1:3DD6A47BD2C1BAF1950E0C8B9445DBB331026975
                                                                                                                                                                    SHA-256:3884AC010768A5FB727DE050321C82D99591B8DFD5F82ACA60987B55D343EBFC
                                                                                                                                                                    SHA-512:24C963EF5EC8DDDF25542DDF9D543F398E8D1474649A73AEAAD58033AE358C068B1D9B1E6FA9AF6134052FA2979445B27F104424D415AEB030EB091311E0D21E
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......p[...........@...........................[.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... ..,.........................@...bqhqoftp.....p@.....................@...grvnhumg.....`[.......#.............@....taggant.0...p[.."....$.............@...................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\IWPfiAXUTJTSHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):159744
                                                                                                                                                                    Entropy (8bit):0.5394293526345721
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                    MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                    SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                    SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                    SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\KvHrxJ77cmUgLogin Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):51200
                                                                                                                                                                    Entropy (8bit):0.8746135976761988
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                    MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                    SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                    SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                    SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\KxZFCNaRhrDevdKhe6iU.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):1166336
                                                                                                                                                                    Entropy (8bit):7.035421328659107
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:CqDEvCTbMWu7rQYlBQcBiT6rprG8aHh2+b+HdiJUt:CTvC/MTQYxsWR7aHh2+b+HoJU
                                                                                                                                                                    MD5:FC157BF81AB006D1BB0A542AAF499C53
                                                                                                                                                                    SHA1:2B5F22AC2158A90EAE8783E05E62171095BBDCE7
                                                                                                                                                                    SHA-256:CADCD8C01844EFD569E6D84E5CF516261A8E43450B2B22D8227A710EAA524909
                                                                                                                                                                    SHA-512:723F661B13ED7CC9444BA0C1038B2DB23716BDE32EF02F504131A4F11E5A23A9186EC527C0D9291F18194E7193D62687BE1F2A5385FFA37D3B1EA95AAAC2F8F8
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 35%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...$..e..........".................w.............@..........................0............@...@.......@.....................d...|....@..l`.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...l`...@...b..................@..@.reloc...u.......v...V..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\QdX9ITDLyCRBWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\UPG2LoPXwc7OWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.1209886597424439
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                                                                                                                    MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                                                                                                                    SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                                                                                                                    SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                                                                                                                    SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\ZunTSaNJLBVfWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.1209886597424439
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                                                                                                                    MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                                                                                                                    SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                                                                                                                    SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                                                                                                                    SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):917504
                                                                                                                                                                    Entropy (8bit):6.5796923326287295
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaWTO:FqDEvCTbMWu7rQYlBQcBiT6rprG8auO
                                                                                                                                                                    MD5:67B659FCDDF2F8C738A12D6E482A076B
                                                                                                                                                                    SHA1:55770081B3C041F8CD03EE37642EDBA2579577F5
                                                                                                                                                                    SHA-256:69B8854E797EFA1FF495D96F6478162F4292C2CAF180EA4438DFBA8677D0930A
                                                                                                                                                                    SHA-512:90D46A119F640E71E1D18F5DD448A5742AAEACFADC91E4232BDC40CBC752311CDC68968AFE0C8C7FC9F47A63D974405371E58E9F9FACD00DBBC031DE83680AB4
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i.e.........."..........P......w.............@..........................`......8.....@...@.......@.....................d...|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\o0qT3dWYBP7ZHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                    Entropy (8bit):0.5407252242845243
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                    MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                    SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                    SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                    SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\oOPEmFmu_xsJCookies

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):0.8475592208333753
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
                                                                                                                                                                    MD5:BE99679A2B018331EACD3A1B680E3757
                                                                                                                                                                    SHA1:6E6732E173C91B0C3287AB4B161FE3676D33449A
                                                                                                                                                                    SHA-256:C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
                                                                                                                                                                    SHA-512:9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\pSE1jchbiT9aHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                    Entropy (8bit):0.5407252242845243
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                                                                                    MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                                                                                    SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                                                                                    SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                                                                                    SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\suOrwW4ZcUbjWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.1209886597424439
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                                                                                                                    MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                                                                                                                    SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                                                                                                                    SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                                                                                                                    SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\02zdBXl47cvzHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):159744
                                                                                                                                                                    Entropy (8bit):0.5394293526345721
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                    MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                    SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                    SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                    SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\02zdBXl47cvzcookies.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):98304
                                                                                                                                                                    Entropy (8bit):0.08235737944063153
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
                                                                                                                                                                    MD5:369B6DD66F1CAD49D0952C40FEB9AD41
                                                                                                                                                                    SHA1:D05B2DE29433FB113EC4C558FF33087ED7481DD4
                                                                                                                                                                    SHA-256:14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
                                                                                                                                                                    SHA-512:771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\2jQJv37iJ0lzCookies

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):1.4418442242308882
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:TsKLopF+SawLUO1Xj8BybdRooACxsxjuU9Xp75SxR1YLgC8DYusk2idRo55H4GE:te+Auy5iwxPU9IqgC8MuskJdi55HDE
                                                                                                                                                                    MD5:A95502DE167B3468D7317D35F8C16422
                                                                                                                                                                    SHA1:EFE39E7E8512D603AAFD2749121096F2D6A58842
                                                                                                                                                                    SHA-256:A6485CED6A2FCC794B4A4F50EC3E5B7F055E688FE23368279FA1A26820763402
                                                                                                                                                                    SHA-512:5F017683D61FC7F292B22863CB54EE0101FC1FD78666751A64AC3958E051B61784B23EF070F459A65414E65ECA6E664476237FC851E32FF47ADEFC5A84B96AF0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\3b6N2Xdh3CYwWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\3b6N2Xdh3CYwplaces.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5242880
                                                                                                                                                                    Entropy (8bit):0.03708713717387235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
                                                                                                                                                                    MD5:85D6E1D7F82C11DAC40C95C06B7B5DC5
                                                                                                                                                                    SHA1:96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
                                                                                                                                                                    SHA-256:D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
                                                                                                                                                                    SHA-512:5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\8ghN89CsjOW1Login Data For Account

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                    Entropy (8bit):0.8553638852307782
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                    MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                    SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                    SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                    SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\BzN7a4ewVcXrTgzQjQz2.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2368000
                                                                                                                                                                    Entropy (8bit):7.961235677287098
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:eUyifO8En01EXhKEuytmKpHc0Cy7d+oMaHOjLxdPrtCI:vSxmmhc0D7d19HO9fC
                                                                                                                                                                    MD5:3AD46004D0FBDA320BC0B683582FE08A
                                                                                                                                                                    SHA1:3DD6A47BD2C1BAF1950E0C8B9445DBB331026975
                                                                                                                                                                    SHA-256:3884AC010768A5FB727DE050321C82D99591B8DFD5F82ACA60987B55D343EBFC
                                                                                                                                                                    SHA-512:24C963EF5EC8DDDF25542DDF9D543F398E8D1474649A73AEAAD58033AE358C068B1D9B1E6FA9AF6134052FA2979445B27F104424D415AEB030EB091311E0D21E
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 45%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..........PE..L......e...............".....V.......p[...........@...........................[.......%...@.................................W...k....`...C.......................................................................................................... . .P..........................@....rsrc....C...`......................@....idata ............................@... ..,.........................@...bqhqoftp.....p@.....................@...grvnhumg.....`[.......#.............@....taggant.0...p[.."....$.............@...................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\D87fZN3R3jFeWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\D87fZN3R3jFeplaces.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5242880
                                                                                                                                                                    Entropy (8bit):0.03708713717387235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
                                                                                                                                                                    MD5:85D6E1D7F82C11DAC40C95C06B7B5DC5
                                                                                                                                                                    SHA1:96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
                                                                                                                                                                    SHA-256:D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
                                                                                                                                                                    SHA-512:5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ...................&...................K..................................j.....-a>.~...|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\Ei8DrAmaYu9KLogin Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):40960
                                                                                                                                                                    Entropy (8bit):0.8553638852307782
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                                                                                    MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                                                                                    SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                                                                                    SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                                                                                    SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HaJpYvk8t0RJ45fl1Ifn.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):917504
                                                                                                                                                                    Entropy (8bit):6.5796923326287295
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaWTO:FqDEvCTbMWu7rQYlBQcBiT6rprG8auO
                                                                                                                                                                    MD5:67B659FCDDF2F8C738A12D6E482A076B
                                                                                                                                                                    SHA1:55770081B3C041F8CD03EE37642EDBA2579577F5
                                                                                                                                                                    SHA-256:69B8854E797EFA1FF495D96F6478162F4292C2CAF180EA4438DFBA8677D0930A
                                                                                                                                                                    SHA-512:90D46A119F640E71E1D18F5DD448A5742AAEACFADC91E4232BDC40CBC752311CDC68968AFE0C8C7FC9F47A63D974405371E58E9F9FACD00DBBC031DE83680AB4
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 22%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L....i.e.........."..........P......w.............@..........................`......8.....@...@.......@.....................d...|....@...........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc........@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\HhXfzERnI4EYVEjNyANc.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3100160
                                                                                                                                                                    Entropy (8bit):7.975874249443056
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:gS9FJHxNhIc1HqApr8PK1ui4B3qRkFgjFCPQwpjuS+BWtB8xg9NMMIRwm:gS9FpxNCcMAGP6U0kFgov1+Rxg9aAm
                                                                                                                                                                    MD5:E2467950D27C4297353607B662102098
                                                                                                                                                                    SHA1:BC041DA517F37EDD108DD9E7E4E5AC1A15990591
                                                                                                                                                                    SHA-256:AC7B729CDC37128C14D5897A4BFB7AE4DB1E18373C283199331B72D6B4AAA09E
                                                                                                                                                                    SHA-512:16306B7B922B618814E2372160553C544B461B92E5ABF4AA60C3A845DDAFA02AF5387849FC9E63739CEC9A14088499547ED95C2BADE9E3956BDD3DC60EECD978
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 39%
                                                                                                                                                                    Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C.........L.....L.....L.....H.G...H.....H.....H...R.L.....L.....L...............E.....-........Rich..................PE..L......e...............".....>....................@.......................................@... .. .... .. .......... ...:...\...x....................................................................................................................................8..................@............p......."...<..............@............@...0.......^..............@................p.......f..............@....................d...f..............@....rsrc...............................@..@.........Py.. ...(..................@....data....P"..p...N".................@...................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\IWPfiAXUTJTSHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):159744
                                                                                                                                                                    Entropy (8bit):0.5394293526345721
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                                                                                    MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                                                                                    SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                                                                                    SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                                                                                    SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\KvHrxJ77cmUgLogin Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):51200
                                                                                                                                                                    Entropy (8bit):0.8746135976761988
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                                                                                    MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                                                                                    SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                                                                                    SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                                                                                    SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\QdX9ITDLyCRBWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):106496
                                                                                                                                                                    Entropy (8bit):1.1373607036346451
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
                                                                                                                                                                    MD5:64BCCF32ED2142E76D142DF7AAC75730
                                                                                                                                                                    SHA1:30AB1540F7909BEE86C0542B2EBD24FB73E5D629
                                                                                                                                                                    SHA-256:B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
                                                                                                                                                                    SHA-512:0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\UPG2LoPXwc7OWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.2648983275691787
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:KrJ/2qOB1nxCkMoSAELyKOMq+8QTQKC+CVumP:K0q+n0Jo9ELyKOMq+8Q74
                                                                                                                                                                    MD5:A5F914C0549EECCA7577EC191C069A9C
                                                                                                                                                                    SHA1:19CDC1C7929EA167344283C9FE1CD0AD5279A884
                                                                                                                                                                    SHA-256:818AB51C0F908E24DAAC683DC10A46C7E599C6B4CE58A384B454B5D1A9B8FB07
                                                                                                                                                                    SHA-512:0A4EF40F699CF2C5B6F28DD5FDFF46682C67E417CB2761AB0E581935AEA0F27BD2F5013B99B33641DBC38DFC67095B5195D0F53DE6FCE4F4DBF46C3F11EF9B8E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\ZunTSaNJLBVfWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 92, cookie 0x36, schema 4, UTF-8, version-valid-for 10
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.2789106066096034
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:Z/2qOB1nxCkcSAELyKOMq+8QTQKC+CVumPy:4q+n0f9ELyKOMq+8Q74y
                                                                                                                                                                    MD5:3220F533A6575837C9A1C6508C9E3FA7
                                                                                                                                                                    SHA1:113F71692EC08B115E60672B4CE084309E4F10BF
                                                                                                                                                                    SHA-256:EFEE4F4CB9D75D15CFF9C6AE3E5BF0A845DB94A7E0AD442E70F57F683FCD1382
                                                                                                                                                                    SHA-512:76671824B2588A1B27A910456139BD7FEEFD5410EAF922CC1C86A6580BFDE325D9A585BBE96146B16A61D8B73E0701ABCFE0DE9BDECD3B3F86B5A8AEFA3BE47C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......\...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\o0qT3dWYBP7ZHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                    Entropy (8bit):0.5612796796346056
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:+DJQbzWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kElOG:+NQ2hH+bDo3iN0Z2TVJkXBBE3ybs
                                                                                                                                                                    MD5:2EF179C9F61369BA45C4DAD1649F8891
                                                                                                                                                                    SHA1:30C071F4BBE105509531377C774CC2D33A9CF076
                                                                                                                                                                    SHA-256:9319193998117B91312F92C7277E05BD29A9F7E2498495123520727CDEE99A94
                                                                                                                                                                    SHA-512:E48BBED529480103EAB57594EDBED96C528D377570B6BBDEEF809AC340A899027A3653BC0FF3658F83B96D6B3192E02917B750102B1029AD1DEA82C394194A3E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\oOPEmFmu_xsJCookies

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):20480
                                                                                                                                                                    Entropy (8bit):0.8475592208333753
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOF30AvJ3qj/880C4pwE1:TeAFawNLopFgU10XJBORJ6px4p7
                                                                                                                                                                    MD5:BE99679A2B018331EACD3A1B680E3757
                                                                                                                                                                    SHA1:6E6732E173C91B0C3287AB4B161FE3676D33449A
                                                                                                                                                                    SHA-256:C382A020682EDEE086FBC56D11E70214964D39318774A19B184672E9FD0DD3E0
                                                                                                                                                                    SHA-512:9CFE1932522109D73602A342A15B7326A3E267B77FFF0FC6937B6DD35A054BF4C10ED79D34CA38D56330A5B325E08D8AFC786A8514C59ABB896864698B6DE099
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\pSE1jchbiT9aHistory

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 2, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):155648
                                                                                                                                                                    Entropy (8bit):0.747743870096874
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:eOSD1DhH+bDo3iN0Z2TVJkXBBE3ybFvOP:LShDhIU3iGAIBBE3qQP
                                                                                                                                                                    MD5:365E4930E0DC7C10BE671A07E5C6850E
                                                                                                                                                                    SHA1:BAE8AAD726772F40367DAA7422DCD6EF8FEBB9D8
                                                                                                                                                                    SHA-256:5D0795F59C7C9FB0C6D797BA4D512C301C4BA5AE9ECD7F645FCB3EEAAA5649D1
                                                                                                                                                                    SHA-512:8051693ED837A475569299C0D1A5303B4B7545D5ECBD7B06EEC25C1699436554F94AA9C3387E336D8B2DE8AFBD1AB786B739695591DD2A0BB57CFFF8247F3D30
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\r3bD9GPTMOGYxgEqy2KG.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1755648
                                                                                                                                                                    Entropy (8bit):7.944092570478896
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24576:XMp5Tjy4W4TOoWyaUeEetFfU3LhXaYLJnxpMYwP2RCspkBRzWhy3TEcO2:664TOo6tFWLxfZQ6CokjWh5
                                                                                                                                                                    MD5:64D74B4DCF40E24D3F163421AD180350
                                                                                                                                                                    SHA1:EE884429F86E6A694E4867D46EDF93307637EE93
                                                                                                                                                                    SHA-256:EBE7EB37705A453FE43B000BB31638040864F7AFCEC0161157EE0C78E0738CE1
                                                                                                                                                                    SHA-512:DF39465AD54A006C45DC5EFDC6E2494148C24394BF4671D7F6147B4F775F6C0AFABA6C189547ABC8A6462B6175734291A98E1EC96A5E75C97920563606C3FA4A
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....$e.........."...0..$............F.. ...`....@.. ....................... F...........`.................................m........`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........6..............@... ..*..........8..............@...edffsevf.....`+......:..............@...xbfgsjgd. ....F.....................@...................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\suOrwW4ZcUbjWeb Data

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):196608
                                                                                                                                                                    Entropy (8bit):1.2648983275691787
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:KrJ/2qOB1nxCkMoSAELyKOMq+8QTQKC+CVumP:K0q+n0Jo9ELyKOMq+8Q74
                                                                                                                                                                    MD5:A5F914C0549EECCA7577EC191C069A9C
                                                                                                                                                                    SHA1:19CDC1C7929EA167344283C9FE1CD0AD5279A884
                                                                                                                                                                    SHA-256:818AB51C0F908E24DAAC683DC10A46C7E599C6B4CE58A384B454B5D1A9B8FB07
                                                                                                                                                                    SHA-512:0A4EF40F699CF2C5B6F28DD5FDFF46682C67E417CB2761AB0E581935AEA0F27BD2F5013B99B33641DBC38DFC67095B5195D0F53DE6FCE4F4DBF46C3F11EF9B8E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\heidiOZ8O8BClDfN5\tkp2xLI98ZeXjg0exnoU.exe

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1931264
                                                                                                                                                                    Entropy (8bit):7.950531071702285
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:X9SgsHz10zjv2bwvVi22uWYINz+6yVYEMpImdRI6n:NjPvMwdV2udQz+6yVYEL6
                                                                                                                                                                    MD5:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    SHA1:3BED11C6CFB071DD688F312DE9856B352C2D6C95
                                                                                                                                                                    SHA-256:A7C76A01FD04927293D662B2817C5F7E113ABB121E6A902E98321A89BEFC5BBE
                                                                                                                                                                    SHA-512:C6580409BB3E35C7A73EA54D7D33740277AD81224386CF0652B6E54B930286E10E982A12AE6454B967A6C8AA11A8272832CD664C1B7095A96665D849C53381CF
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*R..n3.@n3.@n3.@5[.A`3.@5[.A.3.@.^.A|3.@.^.Az3.@.^.A.3.@5[.Az3.@5[.A}3.@n3.@.3.@.].Ao3.@.]u@o3.@.].Ao3.@Richn3.@........................PE..L......e.............................`L...........@...........................L.....~.....@.................................Vp..j....`......................$?L..............................>L..................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... .`+.........................@...kitsnogt.p....1..d..................@...uwuqcgqm.....PL......R..............@....taggant.0...`L.."...V..............@...................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.4593089050301797
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                                                                                                                                    MD5:D910AD167F0217587501FDCDB33CC544
                                                                                                                                                                    SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                                                                                                                                    SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                                                                                                                                    SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\rage131MP.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):13
                                                                                                                                                                    Entropy (8bit):2.6535442970305683
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:L4SSXCF:7SXc
                                                                                                                                                                    MD5:AA167AA8A292EDBCC247FBA8DFBC09E6
                                                                                                                                                                    SHA1:247BB828150CA800A8CDE18970EF3A6D595DAF9A
                                                                                                                                                                    SHA-256:9A8C51DF39FB38D4B1C62105BD692D0794C8EC0F94E97851388C7A77D8F1B132
                                                                                                                                                                    SHA-512:29030CBE983AC90913307CB6D31672C5E3468BA9DD17AC9DA2332F7636716C4DD244FD0861700FCBADB0A40E0BD0AB76992822871FF0DF1B5FCE49F4E367AEEA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:1707773892755

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\tmpaddon

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):453023
                                                                                                                                                                    Entropy (8bit):7.997718157581587
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                                                                                                                                    MD5:85430BAED3398695717B0263807CF97C
                                                                                                                                                                    SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                                                                                                                                    SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                                                                                                                                    SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                                                                                                    C:\Users\user\AppData\Local\Temp\u5VRxrmyjWYJsGnPHociwt5.zip

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2849
                                                                                                                                                                    Entropy (8bit):7.745179212485734
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:9NaYyC3GJ7AipQddUD8YUAbmIiEIkpXLtkkTKll7eo/hNsKM26pH5VGeSn3KJ6Nk:5dGJ0ipQ8D/Uw1Z3TglfhNsFpmJ3KJIU
                                                                                                                                                                    MD5:E0A0535EEC93515673E2657784CCE205
                                                                                                                                                                    SHA1:7F6EA2A0B4757C7AED5375DAE095FBA73EDA9B9C
                                                                                                                                                                    SHA-256:3DFACFC6053AB1B29E8C890EF23CB40F21A92D98BDE2F00F671DC6BF1D6C4888
                                                                                                                                                                    SHA-512:786A015332C511E8CD51E0D1605B54E774013F77FF0E097F138ADCB9A970A887E7E88B436E3C57CE5EDD80CA63D3C7385B3B2E7F5F03BAA6C4F128843BCA9756
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Yara Hits:
                                                                                                                                                                    • Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\u5VRxrmyjWYJsGnPHociwt5.zip, Author: Joe Security
                                                                                                                                                                    Preview:PK.........LX................Cookies\..PK.........LX."0~............Cookies\Chrome_Default.txt...n.@...3..#...6.9.....v...e0.f.c...oU.R{..<.u.uE.....~.V.s...H...BP...p.{4U..m. ..x...:....I.....U.a..PQ[..Z.N|=u...R....DoG0...}..p....M..:]J.......b...v....?.?...-/.P......?...a..c.2.5c.7.E][..b|.....9qW..m....!l....,.tXB........k..,.v-K.s.1N.......k&....b.._S7x..M...v...9X.wL../.,...aeD...X_-..Q........-..$.|..=.....F..z)..6]j.E....d.....6..E.GzC..*.....v`...Y8.....PK.........LXh.}{............information.txt.X.o.F..G..X./wjq..6O.q.%...\.K....qc..6.i...c.8r.y."".........Y..Im..u8.b.*s.. .......c2u.............S.<f...8&.eR-l<J.2#.9.-.t1..el..EJ.p......h!.H....v.%,.ETY..O.....]#mb.Q..d.[J....X..F.M.mp.L.8&...m..<<n....>..v...M.eV..b......e.`..V..*PZ...:b...*.;P{..'.1+}.g..D.<|v...n.z.`R....{.b;..jV7..gc..O..-...D.F.v..9.sS..LeE.^.1..!..Y...N.?...[o..-..f.....c>.4.....$,.6.y%.r....xDw.........Y.A[.&....}]8S.G.`9/VyV=.w.../%WY.J..=..eu...&k@1.3...c.....

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 12 18:39:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2677
                                                                                                                                                                    Entropy (8bit):3.980726912749521
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:8Jrnw0dvOTPKAR7HCUidAKZdA1oehwiZUklqeh9y+3:8Jzw8OL5Rgey
                                                                                                                                                                    MD5:84FE0C8A4DF55C94F673DB7AF43DB868
                                                                                                                                                                    SHA1:E2C7AC6C1B6A1AF8DBCBB1C07BA48A2B0FD9052F
                                                                                                                                                                    SHA-256:240E0EC7C892DD0AB49A9C8B689719390973995D2549ED36B8BF2FA2BCDB6C91
                                                                                                                                                                    SHA-512:A2FD21DE76E815A31907A87E246DCA3586DACBA19578EDF190180016A38541D60F2B162D5333D5DA3A7DC56DACC807E80B087F3CC559E68627316A87860B39EE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.@.. ...$+.,......r9.]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ILX.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VLX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VLX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VLX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VLX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._-.I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 12 18:39:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2679
                                                                                                                                                                    Entropy (8bit):3.9984418299498348
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:8qrnw0dvOTPKAR7HCUidAKZdA1leh/iZUkAQkqehOy+2:8qzw8OL5Ra9Qry
                                                                                                                                                                    MD5:09DFAC291A4F0DD04A70AF2EF4AF1B26
                                                                                                                                                                    SHA1:7041E234C900799640B77298E051404081ADDF12
                                                                                                                                                                    SHA-256:A0C7943A3FFE0C5CB39B9D683B1C5FB597D675D6856AA942FF1B7617D41AB3E6
                                                                                                                                                                    SHA-512:A78E5A9DEA7BC21EDEC3AEC8BFFEAB92FF9BA19D5A7F25C90ED812816B7A66F0A3918BB654A98EC0CB938B64EF7C9D6F21AA70AEC05098A534A940FAC69CFA53
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.@.. ...$+.,....#.^9.]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ILX.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VLX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VLX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VLX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VLX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._-.I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2693
                                                                                                                                                                    Entropy (8bit):4.005598388775724
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:86nw0dvOTPKARbHCUidAKZdA14t5eh7sFiZUkmgqeh7ssy+BX:8ow8OL5RynKy
                                                                                                                                                                    MD5:A2F5A918866B64DEB751D8472FC4E222
                                                                                                                                                                    SHA1:033829320EF80AB131065EB42ECA24FF6D26C5A9
                                                                                                                                                                    SHA-256:73314A3E6D740601A201829416B4C0DF8C6974F0BF620152818008B4790052E9
                                                                                                                                                                    SHA-512:4C831736986213B63E486300F7B1544BFD314F60E308488A085500F49B0358E72989D2C4508AC471A49C68C4A9C6EFD3069D0AE2FCABAB27474D2B0A9453B747
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ILX.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VLX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VLX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VLX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._-.I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 12 18:39:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2681
                                                                                                                                                                    Entropy (8bit):3.995743565641848
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:8Qrnw0dvOTPKAR7HCUidAKZdA16ehDiZUkwqehiy+R:8Qzw8OL5RRky
                                                                                                                                                                    MD5:F16645379C4DFA441A9ECFC529AEBF8A
                                                                                                                                                                    SHA1:217044A45ED37809F83A80593966C7518F6FA1AE
                                                                                                                                                                    SHA-256:86AED45F33F5C358F10C861F34AB59DC04E30E4C350E957C500512FE28A3DBBD
                                                                                                                                                                    SHA-512:F38392D055D171795482CF8109322CB835EAA3E6DC81A157786619C4DBF7DFF33C9A6FED6ABA2C800206E812CDB60262DC69FE7A25CC67B9ACD72C7029BBE31D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.@.. ...$+.,....J.S9.]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ILX.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VLX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VLX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VLX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VLX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._-.I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 12 18:39:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2681
                                                                                                                                                                    Entropy (8bit):3.985981806280696
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:8Arnw0dvOTPKAR7HCUidAKZdA1UehBiZUk1W1qehYy+C:8Azw8OL5RR94y
                                                                                                                                                                    MD5:3694838BF42B7AA7FB6DF57447FEB084
                                                                                                                                                                    SHA1:59851D755596DAAFDC7FB870DCA6097BA27BD442
                                                                                                                                                                    SHA-256:A03EFD42B1EBEAD372CD0680D8C700ACB6221DCF47FAA26B401A717C08DD6328
                                                                                                                                                                    SHA-512:96708A9490FDBA547765DDBB4942B4A6F25827A3C5722EC721853B0FC6061E582CED68CCF8B022675B91084EA1081C84F30BB1EB090EBBCB51E2393A8A848960
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.@.. ...$+.,.....!k9.]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ILX.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VLX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VLX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VLX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VLX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._-.I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Feb 12 18:39:42 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2683
                                                                                                                                                                    Entropy (8bit):3.996238893012426
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:8Iirnw0dvOTPKAR7HCUidAKZdA1duTrehOuTbbiZUk5OjqehOuTbKy+yT+:8Dzw8OL5RuTYTbxWOvTbKy7T
                                                                                                                                                                    MD5:FA6E792E626617AD589769F766857153
                                                                                                                                                                    SHA1:6741D6E42140C5597D9F99ADE64AED4CF2A1F16A
                                                                                                                                                                    SHA-256:CA97C3AB8B1BBDF8A2B5B91D8C0627D1BA9D9C4EFACE4AED362704CAF293F733
                                                                                                                                                                    SHA-512:5FE4CF542690F0D63C9D21D50188E8E29385B67B6A6F0A7FBB01962AD1B05F68906601C4A89271846FEDD76F4579BEC65C0227F4559878DDF9C90A07333D2E13
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.@.. ...$+.,.....YH9.]..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.ILX.....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VLX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VLX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VLX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VLX.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..........._-.I.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeMS131.lnk

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Mon Feb 12 18:39:45 2024, mtime=Mon Feb 12 18:39:45 2024, atime=Mon Feb 12 18:39:40 2024, length=1931264, window=hide
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1191
                                                                                                                                                                    Entropy (8bit):4.91703305078633
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:8XLGqR4dRzgKDkdyVd9PAFjKjOkR7Rzqygm:87GUyR41KjD7RWyg
                                                                                                                                                                    MD5:0E56789AE10803B3C785603C2B6E3B05
                                                                                                                                                                    SHA1:9A360BB5C04458E73505E0C5CB3C18589CEFD0F5
                                                                                                                                                                    SHA-256:B6730E17C74544A7F95A1AD4986197F87CFE473F17C3A7AB617F28C403429DAE
                                                                                                                                                                    SHA-512:CF015687A6B65690AE34AC6B21578C6AEC2AAFE6388465217BC2EFE993683A570F22A0C70133E77DE9F4D4F7A245C2498F1A5484EE57DC29529B31D7F7C20046
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:L..................F.... ...Oh.;.]..N..;.]...EQ8.]...x...................... .:..DG..Yr?.D..U..k0.&...&.......y.Yd.....%.]...`.5.]......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)BLX...........................d...A.p.p.D.a.t.a...B.P.1.....LX....Local.<......EW)BLX.............................X.L.o.c.a.l.....N.1.....LX....Temp..:......EW)BLX.............................+.T.e.m.p.....\.1.....LX....EDGEMS~1..D......LX..LX.......(.......................E.d.g.e.M.S.1.3.1.....h.2..x..LX.. .EDGEMS~1.EXE..L......LX..LX.......(....................\...E.d.g.e.M.S.1.3.1...e.x.e.......i...............-.......h..........._-.I.....C:\Users\user\AppData\Local\Temp\EdgeMS131\EdgeMS131.exe....E.d.g.e.M.S.1.3.1.4.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.E.d.g.e.M.S.1.3.1.\.E.d.g.e.M.S.1.3.1...e.x.e.........|....I.J.H..K..:...`.......X.......284992...........hT..CrF.f4... .l`..Yc...,...E...hT..CrF.f4... .l`..Yc...,...E..............1SPS.XF.L8

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\ExperimentStoreData.json (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (8269), with no line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8269
                                                                                                                                                                    Entropy (8bit):5.00597052790823
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:7LFS+O1U6OdwiOdEiVoslH5jV/ZiwBhZ08jzLb3ha8qcXl1H7OsH9KKH4zLqysJL:N5dimslH5jVhiwBrMs1HtHLHCqysl
                                                                                                                                                                    MD5:F29A648689D50352627D898F4386F903
                                                                                                                                                                    SHA1:9060E2C2374D04466A64745CE791FFB503FC8EFF
                                                                                                                                                                    SHA-256:D53DBFF00982D9CAD41B5AEBA71811C91B9F042F4F960B3B4E681D65E78915F8
                                                                                                                                                                    SHA-512:714F2351354042B9A82578BCF5B19A03A6B92385E7A9F8B9FBE36C3D411449EF4AD5479D0BB76ED81CE59C0C0D84C5A5A1C458137C3B5E372F83F85B65A11638
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T08:19:30.130Z","featureIds":["bookmarks"],"prefs":[],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","experimentType":"r

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\ExperimentStoreData.json.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (8269), with no line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):8269
                                                                                                                                                                    Entropy (8bit):5.00597052790823
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:7LFS+O1U6OdwiOdEiVoslH5jV/ZiwBhZ08jzLb3ha8qcXl1H7OsH9KKH4zLqysJL:N5dimslH5jVhiwBrMs1HtHLHCqysl
                                                                                                                                                                    MD5:F29A648689D50352627D898F4386F903
                                                                                                                                                                    SHA1:9060E2C2374D04466A64745CE791FFB503FC8EFF
                                                                                                                                                                    SHA-256:D53DBFF00982D9CAD41B5AEBA71811C91B9F042F4F960B3B4E681D65E78915F8
                                                                                                                                                                    SHA-512:714F2351354042B9A82578BCF5B19A03A6B92385E7A9F8B9FBE36C3D411449EF4AD5479D0BB76ED81CE59C0C0D84C5A5A1C458137C3B5E372F83F85B65A11638
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"bookmarks-toolbar-default-on":{"slug":"bookmarks-toolbar-default-on","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{},"enabled":true,"featureId":"bookmarks"}]},"active":true,"enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc","experimentType":"nimbus","source":"rs-loader","userFacingName":"Bookmarks Toolbar Default On","userFacingDescription":"An experiment that turns the bookmarks toolbar on by default.","lastSeen":"2023-10-05T08:19:30.130Z","featureIds":["bookmarks"],"prefs":[],"isRollout":false},"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","experimentType":"r

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\Telemetry.FailedProfileLocks.txt

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:very short file (no magic)
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):1
                                                                                                                                                                    Entropy (8bit):0.0
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:X:X
                                                                                                                                                                    MD5:C81E728D9D4C2F636F067F89CC14862C
                                                                                                                                                                    SHA1:DA4B9237BACCCDF19C0760CAB7AEC4A8359010B0
                                                                                                                                                                    SHA-256:D4735E3A265E16EEE03F59718B9B5D03019C07D8B6C51F90DA3A666EEC13AB35
                                                                                                                                                                    SHA-512:40B244112641DD78DD4F93B6C9190DD46E0099194D5A44257B7EFAD6EF9FF4683DA1EDA0244448CB343AA688F5D3EFD7314DAFE580AC0BCBF115AECA9E8DC114
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:2

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\addonStartup.json.lz4 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5320
                                                                                                                                                                    Entropy (8bit):6.6042106566953995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMggiA:zTx2x2t0FDJ4NpkuvjdeplTMp
                                                                                                                                                                    MD5:E3E09D3A459131D9A796509E2B74622E
                                                                                                                                                                    SHA1:5EA797BF89A9F3FA6D145C5050B65A5789D26684
                                                                                                                                                                    SHA-256:56940DF1F209C1289E1FCBDB353AA3308581F3469325BC01584C3C8CC86E09C9
                                                                                                                                                                    SHA-512:7F0DA23EC0F97E0D58DB3B6DB6D2FFBAC077847B8C460F18F03CFA0611B313C6A32854E2F8904443DF257960C6FA81F4B1D19409E489488D49963962E338486F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\addonStartup.json.lz4.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):5320
                                                                                                                                                                    Entropy (8bit):6.6042106566953995
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMggiA:zTx2x2t0FDJ4NpkuvjdeplTMp
                                                                                                                                                                    MD5:E3E09D3A459131D9A796509E2B74622E
                                                                                                                                                                    SHA1:5EA797BF89A9F3FA6D145C5050B65A5789D26684
                                                                                                                                                                    SHA-256:56940DF1F209C1289E1FCBDB353AA3308581F3469325BC01584C3C8CC86E09C9
                                                                                                                                                                    SHA-512:7F0DA23EC0F97E0D58DB3B6DB6D2FFBAC077847B8C460F18F03CFA0611B313C6A32854E2F8904443DF257960C6FA81F4B1D19409E489488D49963962E338486F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\addons.json (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24
                                                                                                                                                                    Entropy (8bit):3.91829583405449
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                    MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                    SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                    SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                    SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"schema":6,"addons":[]}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\addons.json.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):24
                                                                                                                                                                    Entropy (8bit):3.91829583405449
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                    MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                    SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                    SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                    SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"schema":6,"addons":[]}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 8, database pages 7, cookie 0x5, schema 4, UTF-8, version-valid-for 8
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):229376
                                                                                                                                                                    Entropy (8bit):0.7371274729890579
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:w1zkVmvQhyn+Zoz6710NlvMM4333JCN87/LKX+5buX:wjjMmCqZ
                                                                                                                                                                    MD5:2581ED8EB731F69F195D038C605665E6
                                                                                                                                                                    SHA1:674FDF6148A7314145CF079619F59FD63C19481B
                                                                                                                                                                    SHA-256:4A80BEB2FD2E85BB97DC7B8D652920832B289A70D1CD02764F1B8FA1C2F85DF7
                                                                                                                                                                    SHA-512:0ED65DA6C7E858C9EF86438772CFCEF2561F22701CB76467F90A41401E61725CE22E8FA507AA3AA09CE85B63D418B634B7D9C6F10055D4C7D2C4DAE6C8938A94
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j......z..{...{.{j{*z.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db-journal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite Rollback Journal
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):229944
                                                                                                                                                                    Entropy (8bit):0.6443569090104045
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:70u95PNlvMM4333JCN87/LKXNH1zkVmvQhyn+Zoz67t:FjMmCqBs
                                                                                                                                                                    MD5:39FF9B11CC4E1532951891662D05BF1D
                                                                                                                                                                    SHA1:8D0C3C981DDAD4F678B72D7554F519E7681DFF35
                                                                                                                                                                    SHA-256:71FA0ED200E68C691E7571AF954BA5191CD011CBCC49669AAF43EF917CC2E59B
                                                                                                                                                                    SHA-512:FDA78A2D85E6CABFC8D76ADC8DED4CE4799D355DA0EF3FB38AD672312034B8F64E2729C69B467DB5E0D4C8E0BED33AAC22F0DD7A419ECC5E8D0F9FC6B4C00078
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.... .c.....#..%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................k............k................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\content-prefs.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):262144
                                                                                                                                                                    Entropy (8bit):0.04905141882491872
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
                                                                                                                                                                    MD5:8736A542C5564A922C47B19D9CC5E0F2
                                                                                                                                                                    SHA1:CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
                                                                                                                                                                    SHA-256:97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
                                                                                                                                                                    SHA-512:99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\content-prefs.sqlite-journal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite Rollback Journal
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):33288
                                                                                                                                                                    Entropy (8bit):0.3090707212713062
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:7+tb6LCvwae+Q8Uu50xj0aWe9LxYkKA25Q5Go:7Mb6awae+QtMImelekKDa5Go
                                                                                                                                                                    MD5:5C25314720B08009358B979DA916C92D
                                                                                                                                                                    SHA1:242EC3B04AA215139E38D9F3545393230D9CE880
                                                                                                                                                                    SHA-256:40D4026964F6F39ED7D0147E873604AC8FE51CB3BF79647D19D509E901F54CB3
                                                                                                                                                                    SHA-512:F0911953835E8E24DE5C27C4E544BFFBCD7580AB5184D8CD6CD348CF9F5D6E708197D7675A3C67E9BE91551F310ED46B2C643CCE3D1B5E468D4AAC0F69CA05C3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.... .c.....L.z4....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.036251541818329173
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:Gtlv8g+/iv6Zmoll3lv8g+/iv6Z+/fR9//9lXlfl:GtS7VZm4l3S7VZ+/J9XV
                                                                                                                                                                    MD5:CE59E118301F601B5A19FA3B3A87A1DF
                                                                                                                                                                    SHA1:9B85781C1917B3389F0D4240712D88B771FF2CFF
                                                                                                                                                                    SHA-256:5F92C13930F60E5BEFA9737410AAFC31C60DBAA81FFBF95E7765482AF096A8CE
                                                                                                                                                                    SHA-512:940BCD5E220ED3339881047D122B173BF03DCE98F381762396D427A62BDC0BD05CD5BE21743E0564E8EF62B870AC610273BE04BA600BEFDF6D4949F26C913367
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-......................x..=...1...'.1V..<..;..-......................x..=...1...'.1V..<..;........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):65616
                                                                                                                                                                    Entropy (8bit):0.05462460412232742
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:Kn9JlZ4vtlghpTbGta+qp6Xgyj/XllSjEw+R:Kn960pTbGta+qpIdkp+R
                                                                                                                                                                    MD5:7F610DE0505448807CA9EEE4FDC5ED1E
                                                                                                                                                                    SHA1:BE7143D5283F8691F9124CC2C856E6F2512FD6B2
                                                                                                                                                                    SHA-256:81B375D709FC5264A476EE8AEE3329B7CCB3C9177888F6529562CF86B018355B
                                                                                                                                                                    SHA-512:3A011C0A0B8E470515DEF36F9C57A11D6DD0CBD1CA89E47795DBC78A5D449A2BD5C5A4EB140F33F0E5F149179FD3BF1D3212CBF2FF801E3ADBCBDEB17A610C57
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:7....-...........1...'......xJb.........1...'......(7.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\store.json.mozlz4 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):66
                                                                                                                                                                    Entropy (8bit):4.837595020998689
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                    MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                    SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                    SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                    SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\crashes\store.json.mozlz4.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):66
                                                                                                                                                                    Entropy (8bit):4.837595020998689
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                    MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                    SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                    SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                    SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\aborted-session-ping (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):48068
                                                                                                                                                                    Entropy (8bit):5.263956987870374
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:F9g2E5T5TAB1xYJtHIjBAoNx6eAGhjNNhnzFSJXETY:ET5dklN1AGhjNNhnzFSJ1
                                                                                                                                                                    MD5:259CCB5F0E5558E184EE53EFE65B78E6
                                                                                                                                                                    SHA1:6D4BC64B9D6F9A74F20258F6BCC58E3BAA6B6563
                                                                                                                                                                    SHA-256:288EAB8FE2282C9B96EB9D23488E96C4D9FF6087D22CCD7EE7E91671E30BA5C1
                                                                                                                                                                    SHA-512:C804D5F1B35740AF4391BEDD59B4BF162B3B0CB1C95246E5A74FF86E51350041B799B119283C8474B5278852D3DD383D06E50424759F0530268A5F6A3C22B3AB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"type":"main","id":"ddc03287-f5ff-4f42-b159-36fbe354593e","creationDate":"2024-02-12T21:39:17.488Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":14261,"start":7089472,"main":7090799,"selectProfile":7091234,"afterProfileLocked":7091236,"startupCrashDetectionBegin":7097349,"firstPaint":7106790,"firstPaint2":7105957,"sessionRestoreInit":7099766,"sessionRestored":7144530,"createTopLevelWindow":7098221,"AMI_startup_begin":14186232,"XPI_startup_begin":14186237,"XPI_bootstrap_addons_begin":14186243,"XPI_bootstrap_addons_end":14186444,"XPI_startup_end":14186444,"AMI_startup_end":14186448,"XPI_finalUIStartup":14188311,"sessionRestoreInitialized":14188313,"delayedStartupStarted":14232497,"delayedStartupFinished":14233026,"startupInterrupted":0,"debuggerAtt

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\aborted-session-ping.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):48068
                                                                                                                                                                    Entropy (8bit):5.263956987870374
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:F9g2E5T5TAB1xYJtHIjBAoNx6eAGhjNNhnzFSJXETY:ET5dklN1AGhjNNhnzFSJ1
                                                                                                                                                                    MD5:259CCB5F0E5558E184EE53EFE65B78E6
                                                                                                                                                                    SHA1:6D4BC64B9D6F9A74F20258F6BCC58E3BAA6B6563
                                                                                                                                                                    SHA-256:288EAB8FE2282C9B96EB9D23488E96C4D9FF6087D22CCD7EE7E91671E30BA5C1
                                                                                                                                                                    SHA-512:C804D5F1B35740AF4391BEDD59B4BF162B3B0CB1C95246E5A74FF86E51350041B799B119283C8474B5278852D3DD383D06E50424759F0530268A5F6A3C22B3AB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"type":"main","id":"ddc03287-f5ff-4f42-b159-36fbe354593e","creationDate":"2024-02-12T21:39:17.488Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"ver":4,"simpleMeasurements":{"totalTime":14261,"start":7089472,"main":7090799,"selectProfile":7091234,"afterProfileLocked":7091236,"startupCrashDetectionBegin":7097349,"firstPaint":7106790,"firstPaint2":7105957,"sessionRestoreInit":7099766,"sessionRestored":7144530,"createTopLevelWindow":7098221,"AMI_startup_begin":14186232,"XPI_startup_begin":14186237,"XPI_bootstrap_addons_begin":14186243,"XPI_bootstrap_addons_end":14186444,"XPI_startup_end":14186444,"AMI_startup_end":14186448,"XPI_finalUIStartup":14188311,"sessionRestoreInitialized":14188313,"delayedStartupStarted":14232497,"delayedStartupFinished":14233026,"startupInterrupted":0,"debuggerAtt

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\2024-02\1707773957838.d809f4a1-ece8-444e-a328-cbaa4e1dbc8c.health.jsonlz4 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 493 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):445
                                                                                                                                                                    Entropy (8bit):5.540848065617063
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:v05FgoaregU0MVHkUHW/nBeBlSsiWzv91pBR+1XNs7:vaac0Gkr5eBlxiw9Hm1XNs7
                                                                                                                                                                    MD5:E7DCE92610C26776F4D3CE5FE5122418
                                                                                                                                                                    SHA1:9A66668B71F77A9A1F2A782A85A4DD6A8D66B372
                                                                                                                                                                    SHA-256:F8CB674EF558BECF95FDF49C4926CE40D5D87995A9D6B47C83BFC7D8A22476B9
                                                                                                                                                                    SHA-512:D19DAAEA79A8D14779DA6D7B0D5F58FB3DEABDE31B4FE6AEEBA2FF597BDC2FE22B0E34CD94E30422B52625A000F67BCEEDDA56B26EADD6ADDE8BABC48644CFDF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40......k{"type":"health","id":"d809f4a1-ece8-444e-a328-cbaa4e1dbc8c","creationDate":"2024-02-12T21:39:17.838Z","version":4,"applic9...":{"architectur....x86-64","buildI....20230927232528","nam+.xFirefox_..."118.0.1","displayVz......vendor":"Mozilla","platform/...xpcomAbi..q_64-msv....hannel":"release"},"payload.. os.....ZWINNT..00.02.@reas...."immediate","sendFail....{"eUnreachable":1}},"client"...965729a8-84e4-4cad-a75d-ac8181902c4b"}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\archived\2024-02\1707773957838.d809f4a1-ece8-444e-a328-cbaa4e1dbc8c.health.jsonlz4.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 493 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):445
                                                                                                                                                                    Entropy (8bit):5.540848065617063
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:v05FgoaregU0MVHkUHW/nBeBlSsiWzv91pBR+1XNs7:vaac0Gkr5eBlxiw9Hm1XNs7
                                                                                                                                                                    MD5:E7DCE92610C26776F4D3CE5FE5122418
                                                                                                                                                                    SHA1:9A66668B71F77A9A1F2A782A85A4DD6A8D66B372
                                                                                                                                                                    SHA-256:F8CB674EF558BECF95FDF49C4926CE40D5D87995A9D6B47C83BFC7D8A22476B9
                                                                                                                                                                    SHA-512:D19DAAEA79A8D14779DA6D7B0D5F58FB3DEABDE31B4FE6AEEBA2FF597BDC2FE22B0E34CD94E30422B52625A000F67BCEEDDA56B26EADD6ADDE8BABC48644CFDF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40......k{"type":"health","id":"d809f4a1-ece8-444e-a328-cbaa4e1dbc8c","creationDate":"2024-02-12T21:39:17.838Z","version":4,"applic9...":{"architectur....x86-64","buildI....20230927232528","nam+.xFirefox_..."118.0.1","displayVz......vendor":"Mozilla","platform/...xpcomAbi..q_64-msv....hannel":"release"},"payload.. os.....ZWINNT..00.02.@reas...."immediate","sendFail....{"eUnreachable":1}},"client"...965729a8-84e4-4cad-a75d-ac8181902c4b"}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\db\data.safe.bin (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                    Entropy (8bit):4.3732583161137795
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:hXNnXNtSSF9nbkW6zSgB3FnhmRHXNJP/PmXNDHpOr1QtfWZEBTzc:h9n9t9vnbozSg3thgH9JPm9DJU
                                                                                                                                                                    MD5:D9329EEA20EB827531E373D679040641
                                                                                                                                                                    SHA1:E03226025F3754893BBA4F291AAF77DD73D268A0
                                                                                                                                                                    SHA-256:75E91989FB5BF06CF1C20E8B1CA0CA2FC127DA887E07BCAFC2DB02B0D6088E3A
                                                                                                                                                                    SHA-512:E416D51136A17A3D98A83A09F9A3DB0845BB46AA19FBEE8F6C0BD1D9E63C32D1FD7C2CAC062DC8E3407E8C4B004546DF36070111643EBA601766124FF08FC41A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.................app....6.......#.......baseline#legacy.telemetry.client_id9........0...........$.......965729a8-84e4-4cad-a75d-ac8181902c4b!.......events#legacy.telemetry.client_id9........0...........$.......965729a8-84e4-4cad-a75d-ac8181902c4b........events#urlbar.pref_max_results.............................*.......events#urlbar.pref_suggest_data_collection......................'.......events#urlbar.pref_suggest_nonsponsored......................$.......events#urlbar.pref_suggest_sponsored......................#.......events#urlbar.pref_suggest_topsites..............................glean_client_info#app_build#............................20230927232528........glean_client_info#app_channel.............................release%.......glean_client_info#app_display_version.............................118.0.1........glean_client_info#architecture.............................x86_64........glean_client_info#build_date2........)...................1970-01-01T00:00:00+00:00............glean_cl

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):6820
                                                                                                                                                                    Entropy (8bit):4.3732583161137795
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:hXNnXNtSSF9nbkW6zSgB3FnhmRHXNJP/PmXNDHpOr1QtfWZEBTzc:h9n9t9vnbozSg3thgH9JPm9DJU
                                                                                                                                                                    MD5:D9329EEA20EB827531E373D679040641
                                                                                                                                                                    SHA1:E03226025F3754893BBA4F291AAF77DD73D268A0
                                                                                                                                                                    SHA-256:75E91989FB5BF06CF1C20E8B1CA0CA2FC127DA887E07BCAFC2DB02B0D6088E3A
                                                                                                                                                                    SHA-512:E416D51136A17A3D98A83A09F9A3DB0845BB46AA19FBEE8F6C0BD1D9E63C32D1FD7C2CAC062DC8E3407E8C4B004546DF36070111643EBA601766124FF08FC41A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.................app....6.......#.......baseline#legacy.telemetry.client_id9........0...........$.......965729a8-84e4-4cad-a75d-ac8181902c4b!.......events#legacy.telemetry.client_id9........0...........$.......965729a8-84e4-4cad-a75d-ac8181902c4b........events#urlbar.pref_max_results.............................*.......events#urlbar.pref_suggest_data_collection......................'.......events#urlbar.pref_suggest_nonsponsored......................$.......events#urlbar.pref_suggest_sponsored......................#.......events#urlbar.pref_suggest_topsites..............................glean_client_info#app_build#............................20230927232528........glean_client_info#app_channel.............................release%.......glean_client_info#app_display_version.............................118.0.1........glean_client_info#architecture.............................x86_64........glean_client_info#build_date2........)...................1970-01-01T00:00:00+00:00............glean_cl

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\events\background-update

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):954
                                                                                                                                                                    Entropy (8bit):4.746402362231517
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:YsDN5IuZJcJ5r3fnp/6U57oyRQD08IuZJcUzpf+OAh+/6SyRQD5IurPpXa8dJ+RY:YSNtMJ93fDID7MipiGDtt1dcDtt1cfHn
                                                                                                                                                                    MD5:19D94F6D62B35618C7712005661C9758
                                                                                                                                                                    SHA1:B7BBD62D08FE51272237205E86FFE1761D1567DA
                                                                                                                                                                    SHA-256:86D0311B61506EAB83338D3E525099DF8B64007EDD587075DF3D4B312C9A4FEA
                                                                                                                                                                    SHA-512:DD2FDD23F45156E4B89C197FFE66C5DB419FE8DCF13963959E1F1CFE69431F01F97B7456F989261322BBE911E6BBB097EE794B17E4DFC0D75B312C6C971A5C97
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"timestamp":68839,"category":"nimbus_events","name":"enrollment","extra":{"enrollment_id":"93156816-ac33-4be7-bf25-0d6bf496875c","experiment_type":"rollout","experiment":"extensions-migration-in-import-wizard-116-rollout","branch":"control"}}.{"timestamp":69205,"category":"nimbus_events","name":"enrollment","extra":{"experiment":"updated-import-infrequent-rollout-make-yourself-at-home-copy","enrollment_id":"23df87e8-b680-49fd-8c9d-d1006a883dd9","experiment_type":"rollout","branch":"control"}}.{"timestamp":69210,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","feature":"accessibilityCache","experiment":"next-generation-accessibility-engine-powering-screen-readers"}}.{"timestamp":69210,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","experiment":"next-generation-accessibility-engine-powering-screen-readers-and-other-ats-copy","feature":"accessibilityCache"}}.

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\events\events

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1028
                                                                                                                                                                    Entropy (8bit):4.7455852087526615
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:YSgDNtMJ93fDID7MipiGDtt1dcDtt1cfHn:YjZt63LIPBt5C5Ufn
                                                                                                                                                                    MD5:741D1F0617D718BC537DDD91CA70F529
                                                                                                                                                                    SHA1:93A6647FB893CA59C4688E42FDE2C9B166B0CAE9
                                                                                                                                                                    SHA-256:F177646E7012DDCC2BAA0CC2F125C6406EA5A9D13064DAFDBE7AFC21BA57378D
                                                                                                                                                                    SHA-512:C20A9037AF408D6BA3E56110E7ED12E1860FCE93E0D1AEF0A71861F7AEB6F233B13B54B2BEAA35EB40A64B44709693FF110A55CA2D7A13469821C1D24C22EEB0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"timestamp":0,"category":"fog.validation","name":"validate_early_event"}.{"timestamp":68839,"category":"nimbus_events","name":"enrollment","extra":{"enrollment_id":"93156816-ac33-4be7-bf25-0d6bf496875c","experiment_type":"rollout","experiment":"extensions-migration-in-import-wizard-116-rollout","branch":"control"}}.{"timestamp":69205,"category":"nimbus_events","name":"enrollment","extra":{"experiment":"updated-import-infrequent-rollout-make-yourself-at-home-copy","enrollment_id":"23df87e8-b680-49fd-8c9d-d1006a883dd9","experiment_type":"rollout","branch":"control"}}.{"timestamp":69210,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","feature":"accessibilityCache","experiment":"next-generation-accessibility-engine-powering-screen-readers"}}.{"timestamp":69210,"category":"nimbus_events","name":"validation_failed","extra":{"reason":"invalid-feature","experiment":"next-generation-accessibility-engine-powering-screen-readers-and-other-ats-copy","feat

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\061b0173-cecb-452a-9b19-ceec1a83fc58 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (3121)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3191
                                                                                                                                                                    Entropy (8bit):4.928554891706816
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Y0uWLujp49eOdnwSU0U5/SSBphp8XNsYfUCS6Z9NwWLtp4Vphn8F8Z:CRO2SUvachaXNkCSP7Z
                                                                                                                                                                    MD5:9C9E5C2A216CA01757A2EC39701780C3
                                                                                                                                                                    SHA1:A68C432D7B4C98A65BCE36B8750F35C99461D3C3
                                                                                                                                                                    SHA-256:2ACAEB4D7EFA0D4281283E54C216E2CA1BBEE765595C73B03460187995235A0C
                                                                                                                                                                    SHA-512:B9D4429223D5CBEA82C9A21C19262071FE6ABC1FB2C5A33150BEDDE1B54BE2C2BAE3F4BBED0F937BE77ED6C2CAE68919D0B9B02AB3FD5829DB74D2A3C652A978
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/events/1/061b0173-cecb-452a-9b19-ceec1a83fc58.{"ping_info":{"seq":1,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","reason":"startup","experiments":{"bookmarks-toolbar-default-on":{"branch":"control","extra":{"enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc","type":"nimbus-nimbus"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab"}},"ech-roll-out":{"branch":"rollout","extra":{"enrollmentId":"01023358-b900-4567-b563-488481049635","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"8470e331-c68c-4a5b-86ed-1967ab30f009","first_run_dat

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\2ea83aed-d73c-4146-ac4a-138038fe0d7e (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (9946)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10017
                                                                                                                                                                    Entropy (8bit):4.776165674566434
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:PSBSoj8gdirA2a9kz7hfTEbHeiSYep2m/lb+2WhpRx5EfrpAuHXFUk1a9y:Pcj0IYyuHu/Q
                                                                                                                                                                    MD5:FC0CCA6C9B044BB6594469AC2F93A12D
                                                                                                                                                                    SHA1:FE5C7716364E28CEA442A5BC56D4256A1C80D19A
                                                                                                                                                                    SHA-256:DD592D8E5C616C78F56BC0971E927347BBA6AB14E369F19B0643274421467296
                                                                                                                                                                    SHA-512:0C8186C6364CE0FDE3F34A21DC90FFCF355A60AA6F6694F36E9BBAFE8EB938193E4A99591DF0EBAB4C8FCA243CF396F93F957E20AE09920C5958599B5484DA93
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/metrics/1/2ea83aed-d73c-4146-ac4a-138038fe0d7e.{"ping_info":{"seq":0,"start_time":"2024-02-12T22:39+01:00","end_time":"2024-02-12T22:39+01:00","reason":"overdue","experiments":{"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9","type":"nimbus-rollout"}},"ech-roll-out":{"branch":"rollout","extra":{"type":"nimbus-rollout","enrollmentId":"01023358-b900-4567-b563-488481049635"}},"bookmarks-toolbar-default-on":{"branch":"control","extra":{"type":"nimbus-nimbus","enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"8470e331-c68c-4a5b-86ed-1967ab30f009","first_run_da

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\46d27ef2-9d52-4cc4-8518-b2e5ce2a9acf (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1792)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1864
                                                                                                                                                                    Entropy (8bit):5.03108741429037
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:R5v9pX3kaLWLKp3SaDQUkg0qJp8XNsBoO:zD3kCSaD57JaXNxO
                                                                                                                                                                    MD5:D54A883C2BFEDE63889CB72744CAE279
                                                                                                                                                                    SHA1:BC4A3F396D1BBE892C66CCC459C683AE4114D789
                                                                                                                                                                    SHA-256:B3395F7027A7971BDCF4E9FC1796447295396026BDD72F549686A86435236049
                                                                                                                                                                    SHA-512:8D2D6495563DD265ECAEBF6F0A89DA82BD658092740AD7D5B20EE9AEC98DB71F2694804DF96B322C19177D83E750413EE2E8FCE20337765276B801F2E0A4F16E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/baseline/1/46d27ef2-9d52-4cc4-8518-b2e5ce2a9acf.{"ping_info":{"seq":2,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","reason":"active","experiments":{"bookmarks-toolbar-default-on":{"branch":"control","extra":{"type":"nimbus-nimbus","enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc"}},"ech-roll-out":{"branch":"rollout","extra":{"enrollmentId":"01023358-b900-4567-b563-488481049635","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"93156816-ac33-4be7-bf25-0d6bf496875c","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab","type":"nimbus-rollout"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enroll

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\54c697a2-7653-465e-af26-652978bd2ff0 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1033)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1103
                                                                                                                                                                    Entropy (8bit):5.01310333326835
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:BGPXUojMsAaUdJCp8BpSbnGAOZLUIp8XNst7D9TPpmvq:sUo0PxBpRlp8XNstdTPiq
                                                                                                                                                                    MD5:BA2C38CC312468223AEBB597E09B5E57
                                                                                                                                                                    SHA1:919A65FE59E138094671583936B310EFB85F8C3F
                                                                                                                                                                    SHA-256:9C30E46245B2BCCDB92DA1A77D5568B4DC9CA2D794F4A7CA2FFA4CBE0921C584
                                                                                                                                                                    SHA-512:82C0A6D446D8EAB5B67FB9F96088CD43FC5B903669D0A94AB2B6A8804CBA24DF4D432954206D9BBC7C783746AA90015203ED7BC4AD584F19A887C483249DE885
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/newtab/1/54c697a2-7653-465e-af26-652978bd2ff0.{"ping_info":{"seq":6,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","app_build":"20230927232528","app_channel":"release","architecture":"x86_64","os":"Windows","os_version":"10.0","app_display_version":"118.0.1","locale":"en-US","first_run_date":"2023-10-05+02:00","build_date":"1970-01-01T00:00:00+00:00","client_id":"8470e331-c68c-4a5b-86ed-1967ab30f009","windows_build_number":19045},"metrics":{"boolean":{"newtab.search.enabled":true,"topsites.enabled":true,"pocket.enabled":true,"pocket.sponsored_stories_enabled":true,"topsites.sponsored_enabled":true,"pocket.is_signed_in":false},"quantity":{"topsites.rows":1},"string_list":{"newtab.blocked_sponsors":[]},"uuid":{"legacy.telemetry.client_id":"965729a8-84e4-4cad-a75d-ac8181902c4b"},"string":{"newtab.homepage_category":"enabled","search.engine.default.engine_id":"google-

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\a993c97a-1d6a-485f-a17e-0e228ccad620 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1812)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1892
                                                                                                                                                                    Entropy (8bit):5.0833439715403514
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Mva2M9VX3iGSUsWLujp0Ug/3bBpQ+nbfajZT2:Ktc3iGSUYwvHQ+nbijZT2
                                                                                                                                                                    MD5:C55415A687D2427C6673683DAB9D45B0
                                                                                                                                                                    SHA1:A7DFAB1F7ED2CE23DE8789550927DD258BD501D3
                                                                                                                                                                    SHA-256:0550DB09CC27FBBE14D3634D05D4156B863BFD76447FC4C0DE2C13A56BA6479E
                                                                                                                                                                    SHA-512:6A54FB55274CE0F0B368B66D807032EFE7ECCC21A5FF7D5B3004494937B2958D7137314ECE3E6AFA8FBB1DB60842D86EF48D974005305A539DF1E7FA04398BA4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/messaging-system/1/a993c97a-1d6a-485f-a17e-0e228ccad620.{"ping_info":{"seq":16,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","experiments":{"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9","type":"nimbus-rollout"}},"ech-roll-out":{"branch":"rollout","extra":{"type":"nimbus-rollout","enrollmentId":"01023358-b900-4567-b563-488481049635"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"93156816-ac33-4be7-bf25-0d6bf496875c","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"control","extra":{"type":"nimbus-nimbus","enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\pending_pings\b2fd3690-a7d2-4caa-98f7-c4281e698608 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1830)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1910
                                                                                                                                                                    Entropy (8bit):5.103845335032416
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:SnyuX3tWLKpfOdnt6SUVEM9zUn/jCBpQ+v7VYajZTVb3:Ib3/OT6SUVE5bMQ+vppjZTVb3
                                                                                                                                                                    MD5:2F32BF48B15F1A180B926326D9C1D75C
                                                                                                                                                                    SHA1:B9019757F9F0C6565979B099B9EA9F126C01D6E5
                                                                                                                                                                    SHA-256:251108361489B6023A13B0D16B346412E471F639DF548182BB0908F4759A319C
                                                                                                                                                                    SHA-512:98EF73A2914CEB04C55D05BAB3381DD5E3B4682DD7F055374C70D7F5341A5C3E6967460F88A9751D7D5ABB3EB7C3C1485CD8E904BDFCB5E07EAF1F9BE904F806
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/messaging-system/1/b2fd3690-a7d2-4caa-98f7-c4281e698608.{"ping_info":{"seq":17,"start_time":"2024-02-12T22:39+01:00","end_time":"2024-02-12T22:39+01:00","experiments":{"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"93156816-ac33-4be7-bf25-0d6bf496875c","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9"}},"updated-import-infrequent-rollout-make-yourself-at-home-copy":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"23df87e8-b680-49fd-8c9d-d1006a883dd9"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"control",

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\061b0173-cecb-452a-9b19-ceec1a83fc58

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (3121)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):3191
                                                                                                                                                                    Entropy (8bit):4.928554891706816
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Y0uWLujp49eOdnwSU0U5/SSBphp8XNsYfUCS6Z9NwWLtp4Vphn8F8Z:CRO2SUvachaXNkCSP7Z
                                                                                                                                                                    MD5:9C9E5C2A216CA01757A2EC39701780C3
                                                                                                                                                                    SHA1:A68C432D7B4C98A65BCE36B8750F35C99461D3C3
                                                                                                                                                                    SHA-256:2ACAEB4D7EFA0D4281283E54C216E2CA1BBEE765595C73B03460187995235A0C
                                                                                                                                                                    SHA-512:B9D4429223D5CBEA82C9A21C19262071FE6ABC1FB2C5A33150BEDDE1B54BE2C2BAE3F4BBED0F937BE77ED6C2CAE68919D0B9B02AB3FD5829DB74D2A3C652A978
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/events/1/061b0173-cecb-452a-9b19-ceec1a83fc58.{"ping_info":{"seq":1,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","reason":"startup","experiments":{"bookmarks-toolbar-default-on":{"branch":"control","extra":{"enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc","type":"nimbus-nimbus"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab"}},"ech-roll-out":{"branch":"rollout","extra":{"enrollmentId":"01023358-b900-4567-b563-488481049635","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"8470e331-c68c-4a5b-86ed-1967ab30f009","first_run_dat

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\2ea83aed-d73c-4146-ac4a-138038fe0d7e

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (9946)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):10017
                                                                                                                                                                    Entropy (8bit):4.776165674566434
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:PSBSoj8gdirA2a9kz7hfTEbHeiSYep2m/lb+2WhpRx5EfrpAuHXFUk1a9y:Pcj0IYyuHu/Q
                                                                                                                                                                    MD5:FC0CCA6C9B044BB6594469AC2F93A12D
                                                                                                                                                                    SHA1:FE5C7716364E28CEA442A5BC56D4256A1C80D19A
                                                                                                                                                                    SHA-256:DD592D8E5C616C78F56BC0971E927347BBA6AB14E369F19B0643274421467296
                                                                                                                                                                    SHA-512:0C8186C6364CE0FDE3F34A21DC90FFCF355A60AA6F6694F36E9BBAFE8EB938193E4A99591DF0EBAB4C8FCA243CF396F93F957E20AE09920C5958599B5484DA93
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/metrics/1/2ea83aed-d73c-4146-ac4a-138038fe0d7e.{"ping_info":{"seq":0,"start_time":"2024-02-12T22:39+01:00","end_time":"2024-02-12T22:39+01:00","reason":"overdue","experiments":{"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9","type":"nimbus-rollout"}},"ech-roll-out":{"branch":"rollout","extra":{"type":"nimbus-rollout","enrollmentId":"01023358-b900-4567-b563-488481049635"}},"bookmarks-toolbar-default-on":{"branch":"control","extra":{"type":"nimbus-nimbus","enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc"}}}},"client_info":{"telemetry_sdk_build":"53.2.0","client_id":"8470e331-c68c-4a5b-86ed-1967ab30f009","first_run_da

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\46d27ef2-9d52-4cc4-8518-b2e5ce2a9acf

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1792)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1864
                                                                                                                                                                    Entropy (8bit):5.03108741429037
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:R5v9pX3kaLWLKp3SaDQUkg0qJp8XNsBoO:zD3kCSaD57JaXNxO
                                                                                                                                                                    MD5:D54A883C2BFEDE63889CB72744CAE279
                                                                                                                                                                    SHA1:BC4A3F396D1BBE892C66CCC459C683AE4114D789
                                                                                                                                                                    SHA-256:B3395F7027A7971BDCF4E9FC1796447295396026BDD72F549686A86435236049
                                                                                                                                                                    SHA-512:8D2D6495563DD265ECAEBF6F0A89DA82BD658092740AD7D5B20EE9AEC98DB71F2694804DF96B322C19177D83E750413EE2E8FCE20337765276B801F2E0A4F16E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/baseline/1/46d27ef2-9d52-4cc4-8518-b2e5ce2a9acf.{"ping_info":{"seq":2,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","reason":"active","experiments":{"bookmarks-toolbar-default-on":{"branch":"control","extra":{"type":"nimbus-nimbus","enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc"}},"ech-roll-out":{"branch":"rollout","extra":{"enrollmentId":"01023358-b900-4567-b563-488481049635","type":"nimbus-rollout"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"93156816-ac33-4be7-bf25-0d6bf496875c","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab","type":"nimbus-rollout"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"type":"nimbus-rollout","enroll

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\54c697a2-7653-465e-af26-652978bd2ff0

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1033)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1103
                                                                                                                                                                    Entropy (8bit):5.01310333326835
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:BGPXUojMsAaUdJCp8BpSbnGAOZLUIp8XNst7D9TPpmvq:sUo0PxBpRlp8XNstdTPiq
                                                                                                                                                                    MD5:BA2C38CC312468223AEBB597E09B5E57
                                                                                                                                                                    SHA1:919A65FE59E138094671583936B310EFB85F8C3F
                                                                                                                                                                    SHA-256:9C30E46245B2BCCDB92DA1A77D5568B4DC9CA2D794F4A7CA2FFA4CBE0921C584
                                                                                                                                                                    SHA-512:82C0A6D446D8EAB5B67FB9F96088CD43FC5B903669D0A94AB2B6A8804CBA24DF4D432954206D9BBC7C783746AA90015203ED7BC4AD584F19A887C483249DE885
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/newtab/1/54c697a2-7653-465e-af26-652978bd2ff0.{"ping_info":{"seq":6,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","reason":"component_init"},"client_info":{"telemetry_sdk_build":"53.2.0","app_build":"20230927232528","app_channel":"release","architecture":"x86_64","os":"Windows","os_version":"10.0","app_display_version":"118.0.1","locale":"en-US","first_run_date":"2023-10-05+02:00","build_date":"1970-01-01T00:00:00+00:00","client_id":"8470e331-c68c-4a5b-86ed-1967ab30f009","windows_build_number":19045},"metrics":{"boolean":{"newtab.search.enabled":true,"topsites.enabled":true,"pocket.enabled":true,"pocket.sponsored_stories_enabled":true,"topsites.sponsored_enabled":true,"pocket.is_signed_in":false},"quantity":{"topsites.rows":1},"string_list":{"newtab.blocked_sponsors":[]},"uuid":{"legacy.telemetry.client_id":"965729a8-84e4-4cad-a75d-ac8181902c4b"},"string":{"newtab.homepage_category":"enabled","search.engine.default.engine_id":"google-

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\a993c97a-1d6a-485f-a17e-0e228ccad620

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1812)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1892
                                                                                                                                                                    Entropy (8bit):5.0833439715403514
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Mva2M9VX3iGSUsWLujp0Ug/3bBpQ+nbfajZT2:Ktc3iGSUYwvHQ+nbijZT2
                                                                                                                                                                    MD5:C55415A687D2427C6673683DAB9D45B0
                                                                                                                                                                    SHA1:A7DFAB1F7ED2CE23DE8789550927DD258BD501D3
                                                                                                                                                                    SHA-256:0550DB09CC27FBBE14D3634D05D4156B863BFD76447FC4C0DE2C13A56BA6479E
                                                                                                                                                                    SHA-512:6A54FB55274CE0F0B368B66D807032EFE7ECCC21A5FF7D5B3004494937B2958D7137314ECE3E6AFA8FBB1DB60842D86EF48D974005305A539DF1E7FA04398BA4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/messaging-system/1/a993c97a-1d6a-485f-a17e-0e228ccad620.{"ping_info":{"seq":16,"start_time":"2023-10-05T10:19+02:00","end_time":"2024-02-12T22:39+01:00","experiments":{"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9","type":"nimbus-rollout"}},"ech-roll-out":{"branch":"rollout","extra":{"type":"nimbus-rollout","enrollmentId":"01023358-b900-4567-b563-488481049635"}},"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"93156816-ac33-4be7-bf25-0d6bf496875c","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"control","extra":{"type":"nimbus-nimbus","enrollmentId":"fbda1f9b-e03c-4207-94bb-3e5ec8a299dc"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\glean\tmp\b2fd3690-a7d2-4caa-98f7-c4281e698608

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1830)
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1910
                                                                                                                                                                    Entropy (8bit):5.103845335032416
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:SnyuX3tWLKpfOdnt6SUVEM9zUn/jCBpQ+v7VYajZTVb3:Ib3/OT6SUVE5bMQ+vppjZTVb3
                                                                                                                                                                    MD5:2F32BF48B15F1A180B926326D9C1D75C
                                                                                                                                                                    SHA1:B9019757F9F0C6565979B099B9EA9F126C01D6E5
                                                                                                                                                                    SHA-256:251108361489B6023A13B0D16B346412E471F639DF548182BB0908F4759A319C
                                                                                                                                                                    SHA-512:98EF73A2914CEB04C55D05BAB3381DD5E3B4682DD7F055374C70D7F5341A5C3E6967460F88A9751D7D5ABB3EB7C3C1485CD8E904BDFCB5E07EAF1F9BE904F806
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:/submit/firefox-desktop/messaging-system/1/b2fd3690-a7d2-4caa-98f7-c4281e698608.{"ping_info":{"seq":17,"start_time":"2024-02-12T22:39+01:00","end_time":"2024-02-12T22:39+01:00","experiments":{"extensions-migration-in-import-wizard-116-rollout":{"branch":"control","extra":{"enrollmentId":"93156816-ac33-4be7-bf25-0d6bf496875c","type":"nimbus-rollout"}},"serp-ad-telemetry-rollout":{"branch":"control","extra":{"enrollmentId":"d888058a-4128-417a-b550-af1107ae53ab","type":"nimbus-rollout"}},"upgrade-spotlight-rollout":{"branch":"treatment","extra":{"type":"nimbus-rollout","enrollmentId":"245abcba-cf02-4bf6-983c-a2ca3efa6ef9"}},"updated-import-infrequent-rollout-make-yourself-at-home-copy":{"branch":"control","extra":{"type":"nimbus-rollout","enrollmentId":"23df87e8-b680-49fd-8c9d-d1006a883dd9"}},"csv-import-release-rollout":{"branch":"enable-csv-import","extra":{"enrollmentId":"cdbde02e-86fb-4899-ad8a-776106784576","type":"nimbus-rollout"}},"bookmarks-toolbar-default-on":{"branch":"control",

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\datareporting\session-state.json

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):161
                                                                                                                                                                    Entropy (8bit):4.853554808047371
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YWAqKs7HgMHYEXcRGBBm/pWUMf8BwS4uHMRDI5AZ9KQJA2aqnLJrja/H5C:YWAqf7AMHZ2WgB6fQfAI5U9KQOanLFu4
                                                                                                                                                                    MD5:60BE6FC3437EBC6B1546597D46A03FAA
                                                                                                                                                                    SHA1:40835579083B572419147CA47995C320C9CD7B35
                                                                                                                                                                    SHA-256:4BB651A5D7B891E9DE3940463F625B48D3F3C786A8098896EBC3813B9858DDA7
                                                                                                                                                                    SHA-512:7AB02D8A53D77D7FFC5D103BF6E48B284A5FA9EF5CA920E17F577003399A12F8D3073ACEF599DEDB3A663C018E467798B2977AFBB87343D253D6FD90AC3493D8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"sessionId":"7e93aae3-1942-48b2-a2b4-62d23ddd597f","subsessionId":"ad437245-8786-439e-ac11-f3a114b73b9c","profileSubsessionCounter":3,"newProfilePingSent":true}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\extensions.json (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):36830
                                                                                                                                                                    Entropy (8bit):5.185849187264327
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:0I4nvfwkXU4y6f4k4oB4a4IPN84I4/4uw4J424qF4g:0NPa45
                                                                                                                                                                    MD5:6C3BE83A836C11F0781A28C5C276611E
                                                                                                                                                                    SHA1:826B42D0E82A04A59A96150A478A9C63172B7506
                                                                                                                                                                    SHA-256:FB38EDAD3460F248967331080F6C398248DBC215D16E4BAB3E31CE260E1176B7
                                                                                                                                                                    SHA-512:EA67C9DF14F00A17C3044EE63DAFA9E7FA9A4B0F04A4D98CC19F2C9794D6D9A215323E13AD354AF60DE1F31288C565EE4455CFE3B9B8F2877DEF20A4151D4921
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{fc425cd7-ddd8-48c7-9e11-c0b9f650e5fa}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\extensions.json.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):36830
                                                                                                                                                                    Entropy (8bit):5.185849187264327
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:0I4nvfwkXU4y6f4k4oB4a4IPN84I4/4uw4J424qF4g:0NPa45
                                                                                                                                                                    MD5:6C3BE83A836C11F0781A28C5C276611E
                                                                                                                                                                    SHA1:826B42D0E82A04A59A96150A478A9C63172B7506
                                                                                                                                                                    SHA-256:FB38EDAD3460F248967331080F6C398248DBC215D16E4BAB3E31CE260E1176B7
                                                                                                                                                                    SHA-512:EA67C9DF14F00A17C3044EE63DAFA9E7FA9A4B0F04A4D98CC19F2C9794D6D9A215323E13AD354AF60DE1F31288C565EE4455CFE3B9B8F2877DEF20A4151D4921
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{fc425cd7-ddd8-48c7-9e11-c0b9f650e5fa}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\favicons.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1021904
                                                                                                                                                                    Entropy (8bit):6.648417932394748
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                    MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                    SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                    SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                    SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):1021904
                                                                                                                                                                    Entropy (8bit):6.648417932394748
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                    MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                    SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                    SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                    SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                    Malicious:true
                                                                                                                                                                    Antivirus:
                                                                                                                                                                    • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                    Entropy (8bit):4.968220104601006
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                    MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                    SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                    SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                    SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):116
                                                                                                                                                                    Entropy (8bit):4.968220104601006
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                    MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                    SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                    SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                    SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.049739164971036066
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:G5seanMIjseanmC89XIpFl/Ocl/18fgY:2danMIjdanNsOl/hSgY
                                                                                                                                                                    MD5:A182259EC54C8E13C55AF5C10FD7BD51
                                                                                                                                                                    SHA1:51E1ED0F6093810CA450522DA916C235234035A3
                                                                                                                                                                    SHA-256:655C8523595C3B33D6A36B244DCFA14F4F129E6A92B0D41209E59B7EDCC5ED9C
                                                                                                                                                                    SHA-512:9B581AB71FF9521EE5200AB25C4C94A4DFA4C2EDDC069D3BAC122D30D5F32016D45A5793E30E3F8053224B565C246800BE8CFFD402CD036BA07EA5A32B544B6C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-........................f......7;.K.L`.:)}C..-........................f......7;.K.L`.:)}C........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):524704
                                                                                                                                                                    Entropy (8bit):0.06669618611474247
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:nxILy0RbW9LIWyFQVAfQJJx+tSq60WrW4HWs09GuSRM5ljX6J:nxqI99yF3feL+tqApDSa5ljqJ
                                                                                                                                                                    MD5:C43332FCBA494B9F4BE005ECB9B7EBA8
                                                                                                                                                                    SHA1:1F9FF4D3E02B809DC8201390D76D5BAEFFACAF18
                                                                                                                                                                    SHA-256:3FDEB282F00CBC2F772D80BC6362D014E4C212AF043A478F884D7F4C901CEA18
                                                                                                                                                                    SHA-512:24D563BB861C703BEAF5774AF1FD1B0CE4A327AB09ABECA2D8B39A680E32316F4A1C60394FBB8B68EFAA560C6D72131E210CF47C317415E2AB6F1DB4F4E135BA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:7....-.............7;.K.u...N.|...........7;.K*.9.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs-1.js

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):13809
                                                                                                                                                                    Entropy (8bit):5.481996078733477
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:Nz8neRdIYbBp6gyAf+mOWAf3iRyHaXM6aRozKWPab3BF5RDNBw8dT9mSl:NzieqAfZOWAf3kfJeDTrwAw0
                                                                                                                                                                    MD5:2ACFEC35C36AF47A45D5B7E8F09DBDE8
                                                                                                                                                                    SHA1:B2EADE9EECE223FC6FE018EABBEBEE307041E28A
                                                                                                                                                                    SHA-256:F713B40E4AEC7C453D7DEE74C388745E96010E3F90684960F859F5C7F30A8018
                                                                                                                                                                    SHA-512:FDB74E03FDD846C83F9F7900B5EEE495849AAB62497944EB1E8155FD499A1F08F5DE3D3F71E73B6F8B86C6650AEED900C9E485CC2E82ADAED6E378624DC4EB44
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1707773919);..user_pref("app.update.lastUpdateTime.background-update-timer", 1707773919);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-upd

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1809), with CRLF line terminators
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):13809
                                                                                                                                                                    Entropy (8bit):5.481996078733477
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:Nz8neRdIYbBp6gyAf+mOWAf3iRyHaXM6aRozKWPab3BF5RDNBw8dT9mSl:NzieqAfZOWAf3kfJeDTrwAw0
                                                                                                                                                                    MD5:2ACFEC35C36AF47A45D5B7E8F09DBDE8
                                                                                                                                                                    SHA1:B2EADE9EECE223FC6FE018EABBEBEE307041E28A
                                                                                                                                                                    SHA-256:F713B40E4AEC7C453D7DEE74C388745E96010E3F90684960F859F5C7F30A8018
                                                                                                                                                                    SHA-512:FDB74E03FDD846C83F9F7900B5EEE495849AAB62497944EB1E8155FD499A1F08F5DE3D3F71E73B6F8B86C6650AEED900C9E485CC2E82ADAED6E378624DC4EB44
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1707773919);..user_pref("app.update.lastUpdateTime.background-update-timer", 1707773919);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-upd

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\protections.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):65536
                                                                                                                                                                    Entropy (8bit):0.04062825861060003
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
                                                                                                                                                                    MD5:60C09456D6362C6FBED48C69AA342C3C
                                                                                                                                                                    SHA1:58B6E22DAA48C75958B429F662DEC1C011AE74D3
                                                                                                                                                                    SHA-256:FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
                                                                                                                                                                    SHA-512:936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\protections.sqlite-journal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite Rollback Journal
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):33288
                                                                                                                                                                    Entropy (8bit):0.08317902871262663
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:7+/lPkvfgtBl/lquN1P4BEJYqWvLue3FMOrMZ0bQ:7+tPk36Bl/ZnjfJiFxMZn
                                                                                                                                                                    MD5:AA32EE59EED53FD6F5AAF893866F47EB
                                                                                                                                                                    SHA1:CBD6B79BD4C667B8A237318879659009B5B6FA20
                                                                                                                                                                    SHA-256:D18B2FAF6A35B2A3C0BA460CE9125313B53E71BFD650B1FC069042446667EA07
                                                                                                                                                                    SHA-512:4EFB95C4F8FC827DA88CA3E5BE0E4D2DC79CBD893C83BBAF7D2753C1FF755EB20F6C6011BC25ECFE4F2520942BBF262F431C79246F0CA6BCE2454CBF016156C4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.... .c............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ ..........................................................................j.......x..x......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionCheckpoints.json (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):90
                                                                                                                                                                    Entropy (8bit):4.194538242412464
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                    MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                    SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                    SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                    SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionCheckpoints.json.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):90
                                                                                                                                                                    Entropy (8bit):4.194538242412464
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                    MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                    SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                    SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                    SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionstore-backups\recovery.baklz4 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 8516 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2011
                                                                                                                                                                    Entropy (8bit):6.422298197618982
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:npOxqMJ0NbZlV/lvH95OPyA2wfY84+xiykTHTRY:uqMablzyA0xy+
                                                                                                                                                                    MD5:BF45905C25D83483E0C277354353BF17
                                                                                                                                                                    SHA1:8D4E3291614DF77B54AC54583B13B67C7A3DCE1E
                                                                                                                                                                    SHA-256:A199C7C5567206A0D353D0A1B446574427E99D7EE1384F621B7FA073315F1231
                                                                                                                                                                    SHA-512:FDAFBEBAAC11B0D383B9CF074D3483D34FBBDD5A679C13F5445F6BF490AB3FABB7B55C4B1E5EC5441716E0E935C0533C839CF90884D8EC3D59580CA1D8B4338B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40.D!....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://accounts.google.com/","title'....cacheKey":0,"ID":5,"docshellUU...A"{ce38d4a7-7bb7-4f07-b78a-3eba457a0b97}","referrerInfo":"BBoSnxDOS9qmDeAnom1e0AA...w..$EY.....0BAQ..aABAA==V...sultPrincipalURI":null,"hasUso.ateractS...false,"triggering9..._base64":"{\"3\":{}...6docIdentifier":6,"persist":true}],"lastAccessed":1707773926142,"hiddey..searchMode...userContextIdg..attribut...{},"index":1B..questedI..p0,"imag....chrome://global/skin/icons/warning.svg"},,...www.youtub(...#...$..97..$...007436db-4ccb-4db0-99a4-1f8a8f15d7a3o....[/11..._44123..V......R.7...aa581305-def....59-88c5-38cdac0cd54d.......8..._28234..V...3...<.21-...96ef42a7-f174-4938-9473-f7d5e9a23ea8-...2..._72228.......facebook&._video+...)......222...88b3510d-c940-4370-8baf-a649aab3dee92...7`.._448362.../.0.X..T...9d866ecb-763d-4cf5-98b6-8868cf95e25....*..U.._55751&.V.......TypedValuk..Z...........,..Clear":1 .`select...4,"_closedT..@],"_?..

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 8516 bytes
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2011
                                                                                                                                                                    Entropy (8bit):6.422298197618982
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:npOxqMJ0NbZlV/lvH95OPyA2wfY84+xiykTHTRY:uqMablzyA0xy+
                                                                                                                                                                    MD5:BF45905C25D83483E0C277354353BF17
                                                                                                                                                                    SHA1:8D4E3291614DF77B54AC54583B13B67C7A3DCE1E
                                                                                                                                                                    SHA-256:A199C7C5567206A0D353D0A1B446574427E99D7EE1384F621B7FA073315F1231
                                                                                                                                                                    SHA-512:FDAFBEBAAC11B0D383B9CF074D3483D34FBBDD5A679C13F5445F6BF490AB3FABB7B55C4B1E5EC5441716E0E935C0533C839CF90884D8EC3D59580CA1D8B4338B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40.D!....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://accounts.google.com/","title'....cacheKey":0,"ID":5,"docshellUU...A"{ce38d4a7-7bb7-4f07-b78a-3eba457a0b97}","referrerInfo":"BBoSnxDOS9qmDeAnom1e0AA...w..$EY.....0BAQ..aABAA==V...sultPrincipalURI":null,"hasUso.ateractS...false,"triggering9..._base64":"{\"3\":{}...6docIdentifier":6,"persist":true}],"lastAccessed":1707773926142,"hiddey..searchMode...userContextIdg..attribut...{},"index":1B..questedI..p0,"imag....chrome://global/skin/icons/warning.svg"},,...www.youtub(...#...$..97..$...007436db-4ccb-4db0-99a4-1f8a8f15d7a3o....[/11..._44123..V......R.7...aa581305-def....59-88c5-38cdac0cd54d.......8..._28234..V...3...<.21-...96ef42a7-f174-4938-9473-f7d5e9a23ea8-...2..._72228.......facebook&._video+...)......222...88b3510d-c940-4370-8baf-a649aab3dee92...7`.._448362.../.0.X..T...9d866ecb-763d-4cf5-98b6-8868cf95e25....*..U.._55751&.V.......TypedValuk..Z...........,..Clear":1 .`select...4,"_closedT..@],"_?..

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:Mozilla lz4 compressed data, originally 8516 bytes
                                                                                                                                                                    Category:modified
                                                                                                                                                                    Size (bytes):2011
                                                                                                                                                                    Entropy (8bit):6.422298197618982
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:npOxqMJ0NbZlV/lvH95OPyA2wfY84+xiykTHTRY:uqMablzyA0xy+
                                                                                                                                                                    MD5:BF45905C25D83483E0C277354353BF17
                                                                                                                                                                    SHA1:8D4E3291614DF77B54AC54583B13B67C7A3DCE1E
                                                                                                                                                                    SHA-256:A199C7C5567206A0D353D0A1B446574427E99D7EE1384F621B7FA073315F1231
                                                                                                                                                                    SHA-512:FDAFBEBAAC11B0D383B9CF074D3483D34FBBDD5A679C13F5445F6BF490AB3FABB7B55C4B1E5EC5441716E0E935C0533C839CF90884D8EC3D59580CA1D8B4338B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:mozLz40.D!....{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"https://accounts.google.com/","title'....cacheKey":0,"ID":5,"docshellUU...A"{ce38d4a7-7bb7-4f07-b78a-3eba457a0b97}","referrerInfo":"BBoSnxDOS9qmDeAnom1e0AA...w..$EY.....0BAQ..aABAA==V...sultPrincipalURI":null,"hasUso.ateractS...false,"triggering9..._base64":"{\"3\":{}...6docIdentifier":6,"persist":true}],"lastAccessed":1707773926142,"hiddey..searchMode...userContextIdg..attribut...{},"index":1B..questedI..p0,"imag....chrome://global/skin/icons/warning.svg"},,...www.youtub(...#...$..97..$...007436db-4ccb-4db0-99a4-1f8a8f15d7a3o....[/11..._44123..V......R.7...aa581305-def....59-88c5-38cdac0cd54d.......8..._28234..V...3...<.21-...96ef42a7-f174-4938-9473-f7d5e9a23ea8-...2..._72228.......facebook&._video+...)......222...88b3510d-c940-4370-8baf-a649aab3dee92...7`.._448362.../.0.X..T...9d866ecb-763d-4cf5-98b6-8868cf95e25....*..U.._55751&.V.......TypedValuk..Z...........,..Clear":1 .`select...4,"_closedT..@],"_?..

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage.sqlite

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 4, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):4096
                                                                                                                                                                    Entropy (8bit):2.042811512334329
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:JBkSldh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jkSWEUo9LXtR+JdkOnohYsl
                                                                                                                                                                    MD5:21235938025E2102017AC8C9748948A4
                                                                                                                                                                    SHA1:A1EED1C4588724A8396C95FC9923C0A33B360FF8
                                                                                                                                                                    SHA-256:E34B06B180E3F73DC8E441650BB7FE694A9D58E927412D6ED40B0852B784824E
                                                                                                                                                                    SHA-512:D334B419A2A75179C17D7F53BF65FCC132ADE03B21059F0007ACDBB08284A281D8CE1C1CC598E6A070024D0DAE158E2E9618E121342BE068E87A051FE33D6061
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage.sqlite-journal

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:SQLite Rollback Journal
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):2072
                                                                                                                                                                    Entropy (8bit):0.4047449334193228
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:7FEG2l8t+tXlndlp/FlaTX/la/0pMRgSEBtl/StlVltllJWXXN2Y:7+/lH5/xgvBtlq2HN/
                                                                                                                                                                    MD5:C2B7C7DA078FBF81A9E317E766ED6D99
                                                                                                                                                                    SHA1:6165A0F5BF3198D265CC944C0604C1495744A86D
                                                                                                                                                                    SHA-256:C5151ACC1DDEEB945EECCDE11495AAEE33117258F8BCD97EB9C5691704BD4B5B
                                                                                                                                                                    SHA-512:F73C8EDD3EDE5A19CE548791913DE9D209281E60B2D910B9D57EADFF12BE855EA1E2DE0EB8C8AB5CA0310AAFAAE9B33BA30AD111D942BF8063376858B2E677DF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.... .c.....0.S<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.02060845394601122
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:G8lbdi9sAEMSlElbdi9sAEMtfR9//:G0bgOIbgO6J9X
                                                                                                                                                                    MD5:203B1FE5A8A5ACF3A02FC3E801D16989
                                                                                                                                                                    SHA1:648F729BD8DBA6A01FA1BD6ECB4852DD1BF36AB1
                                                                                                                                                                    SHA-256:BBF71E4BA720C6F47570B89DB0FA1C7C8ED0277FC41B48A869D1301221E047C3
                                                                                                                                                                    SHA-512:B3B932F345A718290ACAD89BD1FA923796419A68BA1AB2FA0DF215BDB64ADCF386835A84B3DAEDDA0417B57B0F4E551F2F547351A8D3C344073667E66BDCBFA2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.................................p..g8......t..-.................................p..g8......t........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):32768
                                                                                                                                                                    Entropy (8bit):0.017262956703125623
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                    MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                    SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                    SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                    SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\xulstore.json (copy)

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):141
                                                                                                                                                                    Entropy (8bit):4.527146700950922
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YGNDhK6c2us1pNGHfYS8dJsAulvhJBAuqRrHvN+M4fHlxKgfHwFn:YGNTG/SJsAUv54rH0vHlxKgfQFn
                                                                                                                                                                    MD5:74E2B5FEA591C1050CAD4BED0AFE0EA1
                                                                                                                                                                    SHA1:511B7F71B3F73354282145A5B5824BF13758F262
                                                                                                                                                                    SHA-256:D59735F5C04F870A5E3E272CED57FCBA79E9EE309D228E6EF76D25057D902710
                                                                                                                                                                    SHA-512:29DEED066A22EF405CBB4D01C1F11BDE3E94F019ED6CCC1C9DACEEA78C816C2454E73325B7CB4CB0AED219E27A4D71DA9A47ACBE7EA24B8C55DAE4AA983B155C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"chrome://browser/content/browser.xhtml":{"main-window":{"screenX":"4","screenY":"4","width":"1164","height":"891","sizemode":"maximized"}}}

                                                                                                                                                                    C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\xulstore.json.tmp

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):141
                                                                                                                                                                    Entropy (8bit):4.527146700950922
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:YGNDhK6c2us1pNGHfYS8dJsAulvhJBAuqRrHvN+M4fHlxKgfHwFn:YGNTG/SJsAUv54rH0vHlxKgfQFn
                                                                                                                                                                    MD5:74E2B5FEA591C1050CAD4BED0AFE0EA1
                                                                                                                                                                    SHA1:511B7F71B3F73354282145A5B5824BF13758F262
                                                                                                                                                                    SHA-256:D59735F5C04F870A5E3E272CED57FCBA79E9EE309D228E6EF76D25057D902710
                                                                                                                                                                    SHA-512:29DEED066A22EF405CBB4D01C1F11BDE3E94F019ED6CCC1C9DACEEA78C816C2454E73325B7CB4CB0AED219E27A4D71DA9A47ACBE7EA24B8C55DAE4AA983B155C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:{"chrome://browser/content/browser.xhtml":{"main-window":{"screenX":"4","screenY":"4","width":"1164","height":"891","sizemode":"maximized"}}}

                                                                                                                                                                    C:\Windows\Tasks\explorgu.job

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe
                                                                                                                                                                    File Type:data
                                                                                                                                                                    Category:dropped
                                                                                                                                                                    Size (bytes):294
                                                                                                                                                                    Entropy (8bit):3.4534348358371028
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:G1XUaL1UEZ+lX1yrlbtkHs+Zgty0lu/aldt0:GxJBQ1yriZgtVuGdt0
                                                                                                                                                                    MD5:42EB61A5C28FC5B339AF7BD667745504
                                                                                                                                                                    SHA1:A7428F58108DED882FFDA76E1996F07E98399EC5
                                                                                                                                                                    SHA-256:86F6140E397BFD352DDEEF251C67896B52C265F53F66EE71E835CA57CFE39893
                                                                                                                                                                    SHA-512:5B97583C5B7A3EA03D38BCBD037F37EDDF06C0790CBE3DCADCEB45831A20832C40BFD33C333D172A4C9D1E64071B1379702244A3DF8D46ACE3D8935C89FCDDC7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    Preview:.....}.n.[E.....g.wF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.0.0.c.0.7.2.6.0.d.c.\.e.x.p.l.o.r.g.u...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0.................).@3P.........................

                                                                                                                                                                    Chrome Cache Entry: 742

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):13152
                                                                                                                                                                    Entropy (8bit):7.942425999880835
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:uWxKSXRFQDO08EJWSvLdITJyPsw5gcop+66ycCAXw:uWbFcTvLNPsSxT6fcBw
                                                                                                                                                                    MD5:172436B4BC23C36EAE15A8AA469E053E
                                                                                                                                                                    SHA1:52748A106E3C5D012ABAF63CAF4C9D010CA49974
                                                                                                                                                                    SHA-256:0E91A066E17CDC9B6500ADACE634317A5BF6E885D3E074CD2BBD42675EB5D0AE
                                                                                                                                                                    SHA-512:F782C0910AB6CF1D35272E3B468B219BD2420CE55A5119DF2DD5DD12025E3DC38B442AA6D7B38E502280556376F8537816C1CA7298898D196CC101C92E5DE8DC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-1.xx.fbcdn.net/v/t15.5256-10/423527013_702310635393715_4983219914641772294_n.jpg?stp=dst-jpg_p206x206&_nc_cat=110&ccb=1-7&_nc_sid=1a7029&_nc_ohc=5rerVFq-c7YAX-SF51T&_nc_ht=scontent-atl3-1.xx&oh=00_AfBZ0u-wGWSj581Ln3FiHDdJJsjaVNRZdxFIBUCbzXrWHQ&oe=65CF9F18
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f010000ca050000870b00008f0c0000c10d0000911400002c1e0000401f0000972000000822000060330000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................>....I*..A..*...X.Y ..(.....`..........(...P..a.....".!.. .... ..I.HT...`.....+...... ..I...B....(...@...,.......z../........Q-.....}..>.......,.U:.XK.\.M....{.....9..-..t..t..r-:..F....S....PR...ud.3...Q..g..9..Nlk.9.:T......h.....!:......N..[.k.kU..@Eh*..WDUuD... .1J.$."..j..^.D*.nksR..P-DE.lHLj.o.....hW6....s.t....]..v.....=~6U..T..z../'........o>..D...]|.Zf..]Vu......l=yP,.....%...}:^.;.F.>yz.).h.S.h.<....4..O.4B1..-.R..6.e.>O........w...Z.F.V.;...vU......sH..xD.` ..`Q...O.|...._Wx....l>.eM.z.....7.)*.+k....=~i +..!)^k........y......=.+5{.S....'V~G....\k.......=.@. i..*..x.C.....

                                                                                                                                                                    Chrome Cache Entry: 743

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1623
                                                                                                                                                                    Entropy (8bit):6.99749523034716
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:ghd0QriWUK4wbhd/E0Ka3mRPeM8KdNDHTYeip:q0Ibhd/YimRmsrbE9
                                                                                                                                                                    MD5:A15B64EFE4158963EFF4A8807F1E027A
                                                                                                                                                                    SHA1:13490337D80DBC6E7436A9C3ED12F68A744EEBDF
                                                                                                                                                                    SHA-256:05543798675C68D7B2BF7B6AFFF24CA155BDEBBEB484AE8C4A38D6178101BE24
                                                                                                                                                                    SHA-512:6A9087675C2E4561FDE504D3A8A0D6CCB03110496408AF78EDC1AF77A1FDAD1304DDD8D304B10EFC95686A9892CCBB8240C13C33E0D814C451B969677C9A8F3C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/311001053_406806768282723_4510987411962133191_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=15hz3SQQc5EAX-VegbU&_nc_ht=scontent-atl3-2.xx&oh=00_AfBt_aCGudWpbHUbxXknrBv-XNrUUZI82dtK-d2ogTYf5A&oe=65CF4A9A
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e010000e401000077020000ba02000005030000af030000650400009b040000d20400001505000057060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................6\9E.{..6`..#.A....M.....\..(4,...,X..>. M.xz*;.M.C......../...$..........................."A.. !1..........1.....$r..qF.0...R...].....f'...D~..N;x.!....J..#".i.,.>...._.mD/i#.......Q...qk....T.........yJ*}...............................1!2A........?.dv-9..N!w./B"....].................................1.........?...de..."1..[....V......+........................!1AQ"q.#2. 3ar...........?....(.t...6lu.Sx...w.`1..'.cU.._.V;.....`1.x...N...d...y......hf2.Uy....;%.. ...,....(G..=T...5...._...XU.Qg...i....ce...."....................!1AQa. q............?!f...3.F).G.....c.fBs...o/.....bS.-%.-@.E..W.4U8

                                                                                                                                                                    Chrome Cache Entry: 744

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):219
                                                                                                                                                                    Entropy (8bit):4.761347757859317
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4slhohC/vmI4T7HVaar7D93JnGLXeSV:t4noU/vmRT70arpUXNV
                                                                                                                                                                    MD5:366B82D23090B2A9BA414E77922CE82B
                                                                                                                                                                    SHA1:1EC32038785C0B7E0591E910D0BCB5BDA337F37D
                                                                                                                                                                    SHA-256:BF44FEFE6CEA80E391078F4DC8DA39A1CC34704B2B88F2D6402E3CA9F6DCFA47
                                                                                                                                                                    SHA-512:2DD8EE2C7DBD8CD86C99210C733B33CDE0FD32CAF813E55A74E4C007241CC261EF32B3C091924AE735C50D9A4C80E82DCC38FA643185BF0434B57005C5FAC6F8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_fill/check_circle/v8/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.5 2 2 6.5 2 12s4.5 10 10 10 10-4.5 10-10S17.5 2 12 2zM9.8 17.3l-4.2-4.1L7 11.8l2.8 2.7L17 7.4l1.4 1.4-8.6 8.5z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 745

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):82061
                                                                                                                                                                    Entropy (8bit):7.987793932974626
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:HbCksalMwdw0GiWsyw6ysMnaoIASnMwwhcofNDNG/JBlXf1wE0oE:7CkhlMgSi8BbM7w0cSNo/JBlv1oj
                                                                                                                                                                    MD5:6D975796796290A3709C56DAF430F05C
                                                                                                                                                                    SHA1:89BFB31F2424954BF9269F87CA453019846416F3
                                                                                                                                                                    SHA-256:9D8C4B384BCA390702D05506E176225C35E2887319BF09D4873E6C4EE03A5BF0
                                                                                                                                                                    SHA-512:60DD346553E0671F03224EF2A5DAAF3D855AA0435B6024025508782D73CF193D412F95C3F1389904704D48B3B6DBE2F0BABB83904D597F27DC1E946CA3E91708
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/423134573_345603218342428_43342559393597044_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=Dv0IHT0C7hgAX9a24GV&_nc_ht=scontent-atl3-2.xx&oh=00_AfBCgr7pHzoP2MQNg633qFfGfQs8YQhAe-eWglZbxSkAFA&oe=65CF4158
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000382100003c4e0000e1540000515b0000b784000038c400006eca00007ed10000b6d800008d400100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..........................................................................................G.[.w3Y..^$BBr...].......,Wt....f..zg...U.0VR.....F.$G! ...#7..Ln..R..I#.Y.....:.S.-.`/.=N.....M.Z..S...N."...W.Z..J-,.V...(..".C.....c.X.BN.!,...yv..o.~m.%...0&(."[...:.v$93.&p2..1"....+..9.i`.n........jJ.OY..W..p..iZ%:y.H..{~....{......F,...E.`....,.u.....&w.K....A......+.....^.8.^.w..D.Ds....@..F..L.F$.bE93."..H... .k$...Hd..z.+.p.S...a..Y.6.%P.^d../..............s.Q.y.N.....^.w.I......Q"gy.=.a..c.o.3W ..r...b...8......0 .....B..hr.N.I....Dq..V.t..sIZ5......7.....c.$.2.0.f6..cg&3\...}.........k.<.m\....B..hk,x..6.....\.K..b.i.P-.=..H@.....#.D.$.wg...b!(...69#8.C.

                                                                                                                                                                    Chrome Cache Entry: 746

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (44728)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):590338
                                                                                                                                                                    Entropy (8bit):5.292661009590181
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:vofC9EsBI4Od6DNyzL/O+UO07TzddWUtHJvQSTAXzBZlA1cd9L2ufD+XnPNBtolV:GsBsksW+U9TNtEXzpA1o9aufD+XPulV
                                                                                                                                                                    MD5:843D8FC1DA0EBB1AE91E209A18244428
                                                                                                                                                                    SHA1:22A8A2E93739B09ADCBBAFEA9E6F821BD5801884
                                                                                                                                                                    SHA-256:9EF1D80C38C8CAFE26400BB3732F9376A9F277EE5074F9DF16B633697B337B6A
                                                                                                                                                                    SHA-512:4AE32BFCC210DB5F63F1F58191ADFB807FFBAD00537680A6336C33502B34342A08ED904F108A2C53C0F34E45BCEC457088068FAD0743DAB3816861B03890F4D8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://static.xx.fbcdn.net/rsrc.php/v3/yQ/l/0,cross/43jRaeKgdEZ.css?_nc_x=Ij3Wp8lg5Kz"
                                                                                                                                                                    Preview:form{margin:0;padding:0}label{color:#606770;cursor:default;font-weight:600;vertical-align:middle}label input{font-weight:normal}textarea,.inputtext,.inputpassword{-webkit-appearance:none;border:1px solid #ccd0d5;border-radius:0;margin:0;padding:3px}textarea{max-width:100%}select{border:1px solid #ccd0d5;padding:2px}input,select,textarea{background-color:#fff;color:#1c1e21}.inputtext,.inputpassword{padding-bottom:4px}.inputtext:invalid,.inputpassword:invalid{box-shadow:none}.inputradio{margin:0 5px 0 0;padding:0;vertical-align:middle}.inputcheckbox{border:0;vertical-align:middle}.inputbutton,.inputsubmit{background-color:#4267b2;border-color:#DADDE1 #0e1f5b #0e1f5b #d9dfea;border-style:solid;border-width:1px;color:#fff;padding:2px 15px 3px 15px;text-align:center}.inputaux{background:#ebedf0;border-color:#EBEDF0 #666 #666 #e7e7e7;color:#000}.inputsearch{background:#FFFFFF url(/rsrc.php/v3/yL/r/unHwF9CkMyM.png) no-repeat left 4px;padding-left:17px}.html{touch-action:manipulation}body{back

                                                                                                                                                                    Chrome Cache Entry: 747

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):120
                                                                                                                                                                    Entropy (8bit):4.568105614797637
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:bh6G3XWZNDrMyMcbtugSUhdei3XWZNDrMyMcbz1h8FfY:bnXS5JtpnS5JZh8Fw
                                                                                                                                                                    MD5:D101838E73B156A21EA1FD94EBCEEB1D
                                                                                                                                                                    SHA1:C515B856E4AA0DE6FDAF13536873AFEB0D44D45B
                                                                                                                                                                    SHA-256:01E64CF9DF1DBF2FB4BFA333E3B2838272081B0BD396AACF340A56FA9252E15D
                                                                                                                                                                    SHA-512:A13AA569E36F3C68585965FDCC5B54454264E9EE7CB1BAE695EDF70F0716EA6D71D3E0060B39074BD1EA0E5AE9946B8A1CDF80E7A52BEE1DC8CF8E8E2FE79324
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISFwkbMnFS9SzlUhIFDYOoWz0SBQ3Fk8QkEhcJsA2cf48--pcSBQ14bxIZEgUNxZPEJBIQCXIJePU8PqV8EgUNvYWDDw==?alt=proto
                                                                                                                                                                    Preview:CiIKEw2DqFs9GgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCiIKEw14bxIZGgQICRgBGgQIVhgCIAEKCw3Fk8QkGgQISxgCCg8KDQ29hYMPGgYIARABGAM=

                                                                                                                                                                    Chrome Cache Entry: 748

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (511)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):2051
                                                                                                                                                                    Entropy (8bit):5.245569770149611
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:x2npr4QxmTJsIxHPTNSxf0gzu590yKECxex3XZKE+:x44wmTJsYH7NGf0gKT0yKE2K3pJ+
                                                                                                                                                                    MD5:A94E7CD86F5824E27720F5D3C712DF9A
                                                                                                                                                                    SHA1:7BF52949685727D7133F452B432A57615E40978F
                                                                                                                                                                    SHA-256:59CE6BDF8E3D17BB68667499C34A3EC32B9F7836DBCA59D03237A4C9FFFEFD35
                                                                                                                                                                    SHA-512:726D7BB3C7D356453A10D590EE4806BDE864FC7E909BA8F03E194B1F1BAA0D65AE8FC89E9E393F2300ED3536969E7445AC39860E3BB0EA338EF19F4B51139B9F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/custom-elements-es5-adapter.vflset/custom-elements-es5-adapter.js
                                                                                                                                                                    Preview:'use strict';/*.. Copyright (c) 2016 The Polymer Project Authors. All rights reserved.. This code may only be used under the BSD style license found at http://polymer.github.io/LICENSE.txt. The complete set of authors may be found at http://polymer.github.io/AUTHORS.txt. The complete set of contributors may be found at http://polymer.github.io/CONTRIBUTORS.txt. Code distributed by Google as part of the polymer project is also. subject to an additional IP rights grant found at http://polymer.github.io/PATENTS.txt.*/.(()=>{if(window.customElements){var h=window.HTMLElement,m=window.customElements.define,n=window.customElements.get,k=new Map,l=new Map,e=!1,f=!1;window.HTMLElement=function(){if(!e){var a=k.get(this.constructor);a=n.call(window.customElements,a);f=!0;return new a}e=!1};window.HTMLElement.prototype=h.prototype;window.HTMLElement.es5Shimmed=!0;Object.defineProperty(window,"customElements",{value:window.customElements,configurable:!0,writable:!0});Object.defineProperty(window.

                                                                                                                                                                    Chrome Cache Entry: 749

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:exported SGML document, ASCII text, with very long lines (1120)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):5598
                                                                                                                                                                    Entropy (8bit):4.293279469529671
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:04JsH5RGMp9UC96s4AJu4m35PznhTJAxfxZN0rDRMW8R0aaQWD3rKivMt:0ai9UCgs4AJ/mpzcNx/eMw1QWD70t
                                                                                                                                                                    MD5:2FC13E5E6B51277D7A39CD7AD7D14158
                                                                                                                                                                    SHA1:0C9A5C613E5B853376CF2B96D8501EE5960D09C9
                                                                                                                                                                    SHA-256:9073602654785DE3537C4AA85E69847A0BDC871F8DAECB053C7698D4AFE8F6DE
                                                                                                                                                                    SHA-512:A1F8493CFC4F9C619785D9E39F0E9A54420643C3905193E6D5FFD7531184CA5E5B0FE1B43E7307506ADC01CBB397E4A1CCEA63ACD37304360AACAD8FF06D6DB8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/yt-logo-updated/v2/24px.svg
                                                                                                                                                                    Preview: LINT.IfChange-->.<svg xmlns="http://www.w3.org/2000/svg" id="yt-logo-updated-svg" class="external-icon" viewBox="0 0 90 20">. <svg id="yt-logo-updated" viewBox="0 0 90 20" preserveAspectRatio="xMidYMid meet" xmlns="http://www.w3.org/2000/svg">. <g>. <path d="M27.9727 3.12324C27.6435 1.89323 26.6768 0.926623 25.4468 0.597366C23.2197 2.24288e-07 14.285 0 14.285 0C14.285 0 5.35042 2.24288e-07 3.12323 0.597366C1.89323 0.926623 0.926623 1.89323 0.597366 3.12324C2.24288e-07 5.35042 0 10 0 10C0 10 2.24288e-07 14.6496 0.597366 16.8768C0.926623 18.1068 1.89323 19.0734 3.12323 19.4026C5.35042 20 14.285 20 14.285 20C14.285 20 23.2197 20 25.4468 19.4026C26.6768 19.0734 27.6435 18.1068 27.9727 16.8768C28.5701 14.6496 28.5701 10 28.5701 10C28.5701 10 28.5677 5.35042 27.9727 3.12324Z" fill="#FF0000"></path>. <path d="M11.4253 14.2854L18.8477 10.0004L11.4253 5.71533V14.2854Z" fill="white"></path>. </g>. <g>. <g id="youtube-paths">. <path d="M34.6024 13.0036L31.3945

                                                                                                                                                                    Chrome Cache Entry: 750

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1011), with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1011
                                                                                                                                                                    Entropy (8bit):4.958228722086236
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:WybE3QpQgbgbGNKOkhOXO6FOXOWOvOOpx+FUDx+W:WybEgpQgbgbGNNlOOpx4UDx+W
                                                                                                                                                                    MD5:5306F13DFCF04955ED3E79FF5A92581E
                                                                                                                                                                    SHA1:4A8927D91617923F9C9F6BCC1976BF43665CB553
                                                                                                                                                                    SHA-256:6305C2A6825AF37F17057FD4DCB3A70790CC90D0D8F51128430883829385F7CC
                                                                                                                                                                    SHA-512:E91ECD1F7E14FF13035DD6E76DFA4FA58AF69D98E007E2A0D52BFF80D669D33BEB5FAFEFE06254CBC6DD6713B4C7F79C824F641CB704142E031C68ECCB3EFED3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/cssbin/www-onepick.css
                                                                                                                                                                    Preview:.picker-frame{width:100%;height:100%;border:0;overflow:hidden}.picker.modal-dialog-bg{position:absolute;top:0;left:0;background-color:#fff}.picker.modal-dialog{position:absolute;top:0;left:0;background-color:#fff;border:1px solid #acacac;width:auto;padding:0;z-index:1001;overflow:auto;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-box-shadow:rgba(0,0,0,.2) 0 4px 16px;-moz-box-shadow:rgba(0,0,0,.2) 0 4px 16px;box-shadow:rgba(0,0,0,.2) 0 4px 16px;-webkit-transition:top .5s ease-in-out;-moz-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;-webkit-transition:top .5s ease-in-out;-o-transition:top .5s ease-in-out;transition:top .5s ease-in-out}.picker-min{position:absolute;z-index:1002}.picker.modal-dialog-content{font-size:0;padding:0}.picker.modal-dialog-title{height:0;margin:0}.picker.modal-dialog-title-text,.picker.modal-dialog-buttons{display:none}.picker.modal-dialog-bg,.picker.modal-dialog.picker-dialog{z-index:1999999999

                                                                                                                                                                    Chrome Cache Entry: 751

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 15744, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):15744
                                                                                                                                                                    Entropy (8bit):7.986588355476176
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:z1TLklSElcS5V6qQTMUP07JwirW6RlLwK79/:p7EJ5E2bJwi5jLwK79/
                                                                                                                                                                    MD5:15D9F621C3BD1599F0169DCF0BD5E63E
                                                                                                                                                                    SHA1:7CA9C5967F3BB8BFFEAB24B639B49C1E7D03FA52
                                                                                                                                                                    SHA-256:F6734F8177112C0839B961F96D813FCB189D81B60E96C33278C1983B6F419615
                                                                                                                                                                    SHA-512:D35A47162FC160CD5F806C3BB7FEB50EC96FDFC81753660EAD22EF33F89BE6B1BFD63D1135F6B479D35C2E9D30F2360FFC8819EFCA672270E230635BCB206C82
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
                                                                                                                                                                    Preview:wOF2......=........t..=..........................d..d..^.`.. .T..<.....|..{........6.$.... ..t. ..I.3.%.....8..&....4Z.|t .8.........D...$.uNE.P.E.Ak...=.x.9Xz.`.I..R....#F+B`..}.RP|E...Z\.W[.............C...QB....m...cm.?.F.g.......Q....3......p...L2.[......!+@U..^~.......D.?.......j...U...c..U.l.6{...m.CD].h.t.....Q8.....@P...L.c.....+...ZD..2.K...:..4{g..:..~....v......<..H^.R.'....8....?.;...uy.VW..8=.".F..*.....@E....c....=..Ib.....y8$.a){.......KiIW.&..~.}..1..w.M..{.4......!..{..F.H.5#K...t..5.w...ve;. '......NJ......'(%;...?...D...M.Cq,<.=?.f......._...V..bA.(..37..v....+.uY.C.b.w8AF..3.n.-..'..U%.2....o.l."...^bj..aoF.!`....A....j...'.:Z.u...[..p.GW:U%.Ejq...:I...C........S.C...sJe.6D...<.UM,..&h..z}.y|..9...D..j...n..B.$..T....?../.Q..=B...C._.f.#.:Bo.@]T.(..v..F..+d...". ......R..R..R....!..~A....X............>!`p..,08. 9.../.....r..Q.......Qpg.\ko...C..3..Y.y..t'.d9..>#|..3..?.#..$....i........g5.z....S....{3..Sp..S2..w.6........

                                                                                                                                                                    Chrome Cache Entry: 752

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Unicode text, UTF-8 text, with very long lines (4982)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):52506
                                                                                                                                                                    Entropy (8bit):5.446223619353238
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:ETsMRensj20tJ9Z5Q6K3uwSXiicNPj+C3fPO:ETcnsjDJtQ6K3urYhj9fPO
                                                                                                                                                                    MD5:17B87A315CAF971431D4FA4C7D9FC44A
                                                                                                                                                                    SHA1:7C214FF47A82AD279A7E1A33AD5E5FFEF67A5636
                                                                                                                                                                    SHA-256:C0CE06D78F3164114DFA62A06A1AA60A5101CCD151C69AB697012AE8EE69CB24
                                                                                                                                                                    SHA-512:E7BBCFD53BEB483AE9A46D9BD8FCB7B6CC6B5313FCC7B450AC942E5E42B274CB3A3849E713A31FEC6D378DD13C0BC6646DA3198AF8CE7B0421D0CCBD5D6C5E6B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3iFd24/ys/l/en_US/jO_fov4cxjS.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("useCometTextDirection",["UnicodeBidi","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=(h||d("react")).useMemo,j={LTR:"ltr",NEUTRAL:"auto",RTL:"rtl"};function a(a,b){return i(function(){var c=d("UnicodeBidi").getDirection(a,b);return j[c]},[b,a])}g["default"]=a}),98);.__d("CometRoundedTextInput.react",["BaseFocusRing.react","BaseTextInput.react","CometScreenReaderText.react","Locale","react","stylex","useBaseInputValidators"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i||(i=d("react"));b=i;var k=b.useId,l=b.useState,m={backgroundPlaceholder:{backgroundColor:"xmjcpbm",$$css:!0},backgroundSecondary:{backgroundColor:"x1qhmfi1",$$css:!0},disabledInput:{color:"x1dntmbh",cursor:"x1h6gzvc",$$css:!0},endIcon:{paddingEnd:"xsyo7zv",paddingLeft:null,paddingRight:null,$$css:!0},fontPlaceholder:{color:"x12scifz","::placeholder_color":"x2s2ed0",":focus::placeholder_color":"xq33zhf",$$css:!0},fontSecondary:{color:"xi81zsa",$$css:!0},hideIconAnimation:{transitionDura

                                                                                                                                                                    Chrome Cache Entry: 754

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (405)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1600
                                                                                                                                                                    Entropy (8bit):5.22150717502245
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:kMYD7uIXKNPxDD3HwAntYuTNPx3CBiW4TRxu9yNY6cumXu5yNPxqkphiJy1vc6y/:o75khJnXBVUeRx6yNH15s5u8c7Dvz+rw
                                                                                                                                                                    MD5:3BEA06F7C0C210A1B348F2E59D6F6E58
                                                                                                                                                                    SHA1:208E34B3B5E2DFC04459EF249C31F43EC71AED4C
                                                                                                                                                                    SHA-256:5ED84B73AF6CEE3C68FF6202BBB3BDDC5E42DC8B09EB02F2A518AA70068DC6D2
                                                                                                                                                                    SHA-512:9D517972EC785D712969BD6A65779824F0D5EF9C7AB5335CF7C4451776678ED4E29CA320FDAE192E6B637114F5623D94A2D42E0EAF905FD14D37234DE9E204E8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.ng(_.Nha);_.Ew=function(a){_.I.call(this,a.Ha);this.aa=a.Xa.cache};_.A(_.Ew,_.I);_.Ew.Oa=_.I.Oa;_.Ew.Ba=function(){return{Xa:{cache:_.Wp}}};_.Ew.prototype.execute=function(a){_.wb(a,function(b){var c;_.ef(b)&&(c=b.Za.Ob(b.fb));c&&this.aa.wC(c)},this);return{}};_.yr(_.hia,_.Ew);._.l();._.k("VwDzFe");.var oF=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.Kq;this.ea=a.Ea.metadata;this.da=a.Ea.Bq};_.A(oF,_.I);oF.Oa=_.I.Oa;oF.Ba=function(){return{Ea:{Kq:_.PE,metadata:_.sTa,Bq:_.ME}}};oF.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.wb(a,function(c){var d=2===b.ea.getType(c.Bd())?b.aa.Zb(c):b.aa.aa(c);return _.Lk(c,_.QE)?d.then(function(e){return _.pd(e)}):d},this)};_.yr(_.mia,oF);._.l();._.k("sP4Vbe");._.rTa=new _.gl(_.iia);._.l();._.k("A7fCU");.var UE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.WK};_.A(UE,_.I);UE.Oa=_.I.Oa;UE.Ba=function(){r

                                                                                                                                                                    Chrome Cache Entry: 755

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):749
                                                                                                                                                                    Entropy (8bit):4.70368920713592
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:t4nolW84qhebl8cP5UbKEBnStLJdJad+DB3xELFkXUIx+RWuSrtUjAC9ZiCWInLE:t4olS+2x5UbKrTJ9DA0YWrrmWCFzfIvB
                                                                                                                                                                    MD5:AA920B32443219E3EDFA32DEF5EBD457
                                                                                                                                                                    SHA1:8A4B47D0A2CA261803AA5C1A9DDE7BA3FE15B298
                                                                                                                                                                    SHA-256:E5773339E56DD15D8DAAB94CE6ED5D444D1EF0B61355E20854234605BB2E755B
                                                                                                                                                                    SHA-512:C45BDB233447E1F4D3B4B5174A328E3D8987C9B5E2E12733E5027173B0302919680901C311094714CFC32AC2F2C749DC9EB95FFCAA8F5DA1E5EBEF3FB7225E37
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.gstatic.com/images/branding/productlogos/googleg/v6/36px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="36" viewBox="0 0 36 36" width="36"><path d="M34.32 18.39c0-1.17-.11-2.3-.29-3.39H18v6.48h9.4c-.38 2.19-1.59 4.05-3.42 5.31v4.1h5.28c3.2-2.97 5.06-7.33 5.06-12.5z" fill="#4285F4"/><path d="M18 35c4.59 0 8.44-1.52 11.25-4.12l-5.28-4.1c-1.57 1.08-3.59 1.71-5.97 1.71-4.51 0-8.33-3.02-9.73-7.11H2.82v4.23C5.62 31.18 11.36 35 18 35z" fill="#34A853"/><path d="M8.27 21.39c-.36-1.07-.57-2.21-.57-3.39s.21-2.32.58-3.39v-4.23H2.82C1.67 12.67 1 15.25 1 18s.67 5.33 1.82 7.63l5.45-4.24z" fill="#FBBC05"/><path d="M18 7.5c2.56 0 4.86.88 6.67 2.61l.01.02 4.7-4.7C26.43 2.68 22.59 1 18 1 11.36 1 5.62 4.82 2.82 10.37l5.45 4.23c1.4-4.08 5.22-7.1 9.73-7.1z" fill="#EA4335"/><path d="M1 1h34v34H1z" fill="none"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 756

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (10220)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):78505
                                                                                                                                                                    Entropy (8bit):5.386192924004998
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:drOMDK8NFvtMD636tLdHaOMjKwSo3XItkuSbFdIyM:drOqFEMjc
                                                                                                                                                                    MD5:A757DAE40762AD9CD434FB02590385A4
                                                                                                                                                                    SHA1:8A4A17FF4DB2D9CD97BDE6E4D6256F958EB8457D
                                                                                                                                                                    SHA-256:932D5A066A2FC836FA5BF43BFB84108C80AD7BC5E1A3C073B040B44BD73A0D87
                                                                                                                                                                    SHA-512:148AA6E1431F6A93F2DA7D950F0DD528D3E3F0A740F0832A10517C1CF5A31B60C7AFA0FFA3D084E9FAAF0B10D9F72F78DC32F80DC4790F56A68E46A0300DC865
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3idBq4/y7/l/en_US/p0BO6jyI4hb.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="26010742205205782"}),null);.__d("GroupsCometAnswerAgentEducationModalQuery$Parameters",["GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("GroupsCometAnswerAgentEducationModalQuery_facebookRelayOperation"),metadata:{},name:"GroupsCometAnswerAgentEducationModalQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("coerceRelayImage_image.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:{mask:!1},name:"coerceRelayImage_image",selections:[{alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"scale",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"width",st

                                                                                                                                                                    Chrome Cache Entry: 757

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:PNG image data, 10 x 10, 8-bit/color RGB, non-interlaced
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):79
                                                                                                                                                                    Entropy (8bit):4.71696959175789
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:yionv//thPlH1tnt/tAhHGZscm1olkqCwbp:6v/lhP6hHDcZCYp
                                                                                                                                                                    MD5:8DC258A49B60FAE051E9A7CE11AD05CF
                                                                                                                                                                    SHA1:DAFEF280663F4205FC7F0E47799E9945E6A68D6D
                                                                                                                                                                    SHA-256:C8CAED93847AFFC154CB3D424E34FC146E7340BB29ABEBD5EBA7063E3DCA0604
                                                                                                                                                                    SHA-512:5F11ED60D79A80EF7CCEFFA907CD55F31D8DB19BD2A7F4C2650C62A355C5071C5FB61DA1EB0A2071CE22ECDC35C0D12F51E4D13AAC3B0FDB95ED4629815B5AFB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent.xx.fbcdn.net/hads-ak-prn2/1487645_6012475414660_1439393861_n.png
                                                                                                                                                                    Preview:.PNG........IHDR..............PX.....IDAT.Wc...0a.!..)....A,....Zl....IEND.B`.

                                                                                                                                                                    Chrome Cache Entry: 758

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (936)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):5863
                                                                                                                                                                    Entropy (8bit):5.542506058381083
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:ercpdAw1xFVObY2GhlzSSt0531195315WnGIjkC4EBBIjKuKSwXr6:ekdAMFVObY2GjDm19D5WnGIj8OByKD6
                                                                                                                                                                    MD5:F3356B556175318CF67AB48F11F2421B
                                                                                                                                                                    SHA1:ACE644324F1CE43E3968401ECF7F6C02CE78F8B7
                                                                                                                                                                    SHA-256:263C24AC72CB26AB60B4B2911DA2B45FEF9B1FE69BBB7DF59191BB4C1E9969CD
                                                                                                                                                                    SHA-512:A2E5B90B1944A9D8096AE767D73DB0EC5F12691CF1AEBD870AD8E55902CEB81B27A3C099D924C17D3D51F7DBC4C3DD71D1B63EB9D3048E37F71B2F323681B0AD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/www-i18n-constants-en_US.vflset/www-i18n-constants.js
                                                                                                                                                                    Preview:(function(){'use strict';/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var e=this||self;function f(c,b){c=c.split(".");var a=e;c[0]in a||"undefined"==typeof a.execScript||a.execScript("var "+c[0]);for(var d;c.length&&(d=c.shift());)c.length||void 0===b?a[d]&&a[d]!==Object.prototype[d]?a=a[d]:a=a[d]={}:a[d]=b}.;var g={YEAR_FULL:"y",YEAR_FULL_WITH_ERA:"y G",YEAR_MONTH_ABBR:"MMM y",YEAR_MONTH_FULL:"MMMM y",YEAR_MONTH_SHORT:"MM/y",MONTH_DAY_ABBR:"MMM d",MONTH_DAY_FULL:"MMMM dd",MONTH_DAY_SHORT:"M/d",MONTH_DAY_MEDIUM:"MMMM d",MONTH_DAY_YEAR_MEDIUM:"MMM d, y",WEEKDAY_MONTH_DAY_MEDIUM:"EEE, MMM d",WEEKDAY_MONTH_DAY_YEAR_MEDIUM:"EEE, MMM d, y",DAY_ABBR:"d",MONTH_DAY_TIME_ZONE_SHORT:"MMM d, h:mm\u202fa zzzz"},h=g;h=g;var k={ERAS:["BC","AD"],ERANAMES:["Before Christ","Anno Domini"],NARROWMONTHS:"JFMAMJJASOND".split(""),STANDALONENARROWMONTHS:"JFMAMJJASOND".split(""),MONTHS:"January February March April May June July August September October November December

                                                                                                                                                                    Chrome Cache Entry: 759

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (7990)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):465283
                                                                                                                                                                    Entropy (8bit):5.569497285043464
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:WQELY2kiAGWx0KDCJcrjrMwmvsPJ80cF2elRDKRsHuQaR9stKc7S/i18EvJZGwSy:C9Eelhksy9sUc7S618+ZGxrpsU6Frdxr
                                                                                                                                                                    MD5:CEB2ADE4562F9FB063090AE810F38C16
                                                                                                                                                                    SHA1:F47B59DEFD5F6077AEE68B3BF5692CDAD94E0768
                                                                                                                                                                    SHA-256:2B3D33E6C10E813F43D9A13725B4A1C7AA76881D30733F37ECA0B603E74565C3
                                                                                                                                                                    SHA-512:C3A15A0853B1046D27370CFE18AE189067CE1123A7FA5E9502676D3F7D6E1A7A9CFE31545476E2004C7A1E9C796C1171D7F354004412A3222D5B78CAC5452978
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3ifrz4/ym/l/en_US/-e43VxiiGS-.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometBatchNotificationsStateChangeSubscription_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="6546596222061607"}),null);.__d("CometBatchNotificationsStateChangeSubscription.graphql",["CometBatchNotificationsStateChangeSubscription_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a=function(){var a={defaultValue:null,kind:"LocalArgument",name:"environment"},c={defaultValue:null,kind:"LocalArgument",name:"input"},d=[{alias:null,args:[{kind:"Variable",name:"data",variableName:"input"}],concreteType:"BatchNotificationStateChangeSubscribeResponsePayload",kind:"LinkedField",name:"batch_notification_state_change_subscribe",plural:!1,selections:[{alias:null,args:null,concreteType:"Notification",kind:"LinkedField",name:"aggregated_notifications",plural:!0,selections:[{alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"seen_state",storageKey:null}],storageKey:null},{alias:null,args:nu

                                                                                                                                                                    Chrome Cache Entry: 760

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):4668
                                                                                                                                                                    Entropy (8bit):7.909550854394601
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:T/On4SeSrgsj/eOyyESjjy6Uo2Jq9XGq19BEa0ha6p9iQphe:DOn4SeSsi/SyEgBGQ9WRhhfi24
                                                                                                                                                                    MD5:47353A73F10E8287B56D4B1EF07293F1
                                                                                                                                                                    SHA1:843E872E745A4CDE6FA2D0821D6E812496DC218E
                                                                                                                                                                    SHA-256:35997E11D77D4FF858B2002C3D15CB008F80CAB9B6A3111C3D89D5DDE6425003
                                                                                                                                                                    SHA-512:6193F422EF8F21B4A515DB3F163675B4615FBCCCF3AD1F0BBB83E37CFB2D0D22C3F10BB8AC5FC803330E831C2A819E6B277531666686A31E5431372F42E61A1B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://yt3.ggpht.com/50XH72k-ujPDDkt69_evBcmEF_ZeH9BGZBvz489rkdF13MXJiTbD0WEUM809MQohXg_55L6m=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                    Preview:......JFIF......................................................................................................................................................D.D...........................................2............................!."1..A#2QSa..3b..%B.................................<.........................!1A.."aQ..2q...R....#3BTb....................?.j})P.Z.<7B...|..&?N.zb.....$i.Os.*".......)J..?..k.H.[...a...n-..VN'.(..._.T_[.B..J.Yws....~M.eV...&...e?..$.)..Q:R.U...S?.....H.n6_...o....,..k.K.k.5#....-...q'.}aD.D......Jg=.}P....Y..........2B......a..cU.f..UU....*.t.gJT/Y5k..3..rw.zx..............*.n...n..y......G.'..X.Rj............).~.@EJ...t..^./......s.+.k]..;..e. ..'.=)].. .1..l-.....I..Sj\e.O.H..?.JTK.+>zR........]..i./!e.Z...ns...b.K......T%.(.)L..)m...a.z..L#.j..:..Q..o..F.3..zo}.O.pP..2.U+.....%...b3..n...pq.u....X.{..2@.U..#..uv....s........*B...b......'.q\Ty.Td....../..Iv..:.L..)..'...H..+%.b6.g...Q........>...Fv..8.v1.YB3+...

                                                                                                                                                                    Chrome Cache Entry: 761

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (4199)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):19218
                                                                                                                                                                    Entropy (8bit):5.380044510773152
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:Y6rIvz2sGoTEj0LaBS41nUV4By2cONRts7J2WF1d9C:Y6k0oTEj0Op1X9cOLts7DF1d9C
                                                                                                                                                                    MD5:816AB1606A82CE88D4C52DE62D3F6E68
                                                                                                                                                                    SHA1:BEDFCEF9BEB55A5353475897BA1DFADCE34C2E08
                                                                                                                                                                    SHA-256:BE5954FE9E47542CD045B4F3D8DB8B735183CEC69869AA381E62F4F3A7A6FB01
                                                                                                                                                                    SHA-512:2BE640752C20221AFDA9142DDAB6CAEC85BCA1FE3396FDCAE9CBB39DEFCD8097482E967286D85D8DDE1908FAC36B253004960D54AAFA246568CF32C75C215CDD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Hv=function(a){this.Ga=_.t(a)};_.A(_.Hv,_.v);_.Iv=function(a,b){return _.Ad(a,3,b,_.Cc)};_.Hv.Gb=[1,2,3,4];.var PAa=_.ea.URL,QAa,RAa,TAa,SAa;try{new PAa("http://example.com"),QAa=!0}catch(a){QAa=!1}RAa=QAa;.TAa=function(a){var b=_.ei("A");try{_.Ee(b,_.ze(a));var c=b.protocol}catch(e){throw Error("cc`"+a);}if(""===c||":"===c||":"!=c[c.length-1])throw Error("cc`"+a);if(!SAa.has(c))throw Error("cc`"+a);if(!b.hostname)throw Error("cc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};SAa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host=.b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.UAa=function(a){if(RAa){try{var b=new PAa(a)}catch(d){throw Error("cc`"+a);}var c=SAa.get(b

                                                                                                                                                                    Chrome Cache Entry: 762

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (19354)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):2064305
                                                                                                                                                                    Entropy (8bit):5.49331786163357
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:lXhyqJDQCIlaZtrXUynanXrilKYrRGSvKVuIlUHteFS:lXhyF4LbUynanGj1GSvKVuIc
                                                                                                                                                                    MD5:E91005EABA8B1280EFE135751E5F1EDE
                                                                                                                                                                    SHA1:782F652D330A4209FAAE0EC5181980C1FB1C9557
                                                                                                                                                                    SHA-256:E7E6B6C975B8C121BEB49C96F3283627FA64F3B23918C2BAC741E50F5BF68D6D
                                                                                                                                                                    SHA-512:884F44D8A236F998538941F1A08D8655F880406E49A56E156BE6548B5FAA9BF1D9A0686C68579BDBA79F66099770A30EC2F81EB5D8CF589774DB20E35F1D7E51
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3i6gE4/yH/l/en_US/JkX6DCEaxKk.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometStyleXDarkTheme",[],(function(a,b,c,d,e,f){e.exports={"fds-black":"black","fds-black-alpha-05":"rgba(0, 0, 0, 0.05)","fds-black-alpha-10":"rgba(0, 0, 0, 0.1)","fds-black-alpha-15":"rgba(0, 0, 0, 0.15)","fds-black-alpha-20":"rgba(0, 0, 0, 0.2)","fds-black-alpha-30":"rgba(0, 0, 0, 0.3)","fds-black-alpha-40":"rgba(0, 0, 0, 0.4)","fds-black-alpha-50":"rgba(0, 0, 0, 0.5)","fds-black-alpha-60":"rgba(0, 0, 0, 0.6)","fds-black-alpha-80":"rgba(0, 0, 0, 0.8)","fds-blue-05":"black","fds-blue-30":"black","fds-blue-40":"black","fds-blue-60":"black","fds-blue-70":"black","fds-blue-80":"black","fds-button-text":"black","fds-comment-background":"black","fds-dark-mode-gray-35":"black","fds-dark-mode-gray-50":"black","fds-dark-mode-gray-70":"black","fds-dark-mode-gray-80":"black","fds-dark-mode-gray-90":"black","fds-dark-mode-gray-100":"black","fds-gray-00":"black","fds-gray-05":"black","fds-gray-10":"black","fds-gray-20":"black","fds-gray-25":"black","fds-gray-30":"black","

                                                                                                                                                                    Chrome Cache Entry: 763

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (4199)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):19218
                                                                                                                                                                    Entropy (8bit):5.380044510773152
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:Y6rIvz2sGoTEj0LaBS41nUV4By2cONRts7J2WF1d9C:Y6k0oTEj0Op1X9cOLts7DF1d9C
                                                                                                                                                                    MD5:816AB1606A82CE88D4C52DE62D3F6E68
                                                                                                                                                                    SHA1:BEDFCEF9BEB55A5353475897BA1DFADCE34C2E08
                                                                                                                                                                    SHA-256:BE5954FE9E47542CD045B4F3D8DB8B735183CEC69869AA381E62F4F3A7A6FB01
                                                                                                                                                                    SHA-512:2BE640752C20221AFDA9142DDAB6CAEC85BCA1FE3396FDCAE9CBB39DEFCD8097482E967286D85D8DDE1908FAC36B253004960D54AAFA246568CF32C75C215CDD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=RqjULd"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Hv=function(a){this.Ga=_.t(a)};_.A(_.Hv,_.v);_.Iv=function(a,b){return _.Ad(a,3,b,_.Cc)};_.Hv.Gb=[1,2,3,4];.var PAa=_.ea.URL,QAa,RAa,TAa,SAa;try{new PAa("http://example.com"),QAa=!0}catch(a){QAa=!1}RAa=QAa;.TAa=function(a){var b=_.ei("A");try{_.Ee(b,_.ze(a));var c=b.protocol}catch(e){throw Error("cc`"+a);}if(""===c||":"===c||":"!=c[c.length-1])throw Error("cc`"+a);if(!SAa.has(c))throw Error("cc`"+a);if(!b.hostname)throw Error("cc`"+a);var d=b.href;a={href:d,protocol:b.protocol,username:"",password:"",hostname:b.hostname,pathname:"/"+b.pathname,search:b.search,hash:b.hash,toString:function(){return d}};SAa.get(b.protocol)===b.port?(a.host=a.hostname,a.port="",a.origin=a.protocol+"//"+a.hostname):(a.host=.b.host,a.port=b.port,a.origin=a.protocol+"//"+a.hostname+":"+a.port);return a};._.UAa=function(a){if(RAa){try{var b=new PAa(a)}catch(d){throw Error("cc`"+a);}var c=SAa.get(b

                                                                                                                                                                    Chrome Cache Entry: 764

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):75864
                                                                                                                                                                    Entropy (8bit):7.983837749789812
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:v2Zg29Qvum0t/z6Mj9EJtEf2rT3cnuVe4CB/qz4ED9ui4DRLfMqCvu5:vhbtyeMj7f2I/qz480hf9Cvu5
                                                                                                                                                                    MD5:C1292553823DBC85068BC5E7422108F0
                                                                                                                                                                    SHA1:DEFF453722F83408F516038AEAC0FEEA30F8D591
                                                                                                                                                                    SHA-256:9CCDB874776A344F215B3A9FF5737E663511D054103C99C9A29C2654A54E8C1F
                                                                                                                                                                    SHA-512:6F5F4CBC60382C90BD4E6EAC7DB4F85020781D99AEB0C1AE8F0B2D73F8CE4CC706193C415EED746FD31E2A22D9198E5B83BB7AFBD28A5A642F96D7521F072CEF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426290153_2198728963653807_1306475273264039937_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=4mP0rHVPcCYAX8Ll5cQ&_nc_ht=scontent-atl3-2.xx&oh=00_AfDAqkrtEE6a_B-6DlkvQi46Wt0SyRNQg7I7ohlDycTIzw&oe=65CEEA61
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a71010000d51d000056440000094e0000265300007e7600004bad000086b30000cbbc0000f2c3000058280100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................PpC"..Y./&.....H....&.....J....a..........1Y..d....b.B.b4..S...2%,.bm!.,.hhR`@.....5 ..........&..L... ..&....&.4$..hI.....n...d...d..L..C..!...bb..#...&.Y!&.2.5!..!....HI.c.B.@.. ..n.P..1m...@.4..d....`&.`....#...$.BL.a......!&.b....4$.,.......4..4!.`.@...@...`...,...L...$....b2...Y..HCBY#.sF+,`c.F). I.........1....`..`....Y L......&..$..%.SRC@..`...H.5.........$.A...b.!..C ..`.I.........L1.!.&....&C..JId.......+%.S..,r.prL.4..1......@.4..9._...\..>.o.Sr...[..$.j....BY!&..I.1M@@!.MI&......$.B...@....`..h.....i..{...+.L.VNu....y..u.#...).L!.C...a....!.b..S.4b.I..X.....jW)......I...........0.....W...

                                                                                                                                                                    Chrome Cache Entry: 765

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (555)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1260516
                                                                                                                                                                    Entropy (8bit):5.635535680308213
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:+CoW9rN4f2pfFUP5ub/J4cIf8ZUDkqS3n8Uc9zsU:+Cddicb/J4ce1kN8U6zsU
                                                                                                                                                                    MD5:AC392FBC20BB1A19ED63179B97EE6DD4
                                                                                                                                                                    SHA1:B5B98B2C13597826BDC4DA18418FF3FA4457702B
                                                                                                                                                                    SHA-256:66813B8EBBB1CCD70CE149F8586DE3527D3A339D2F085465CE073EFE69CB0B75
                                                                                                                                                                    SHA-512:D90DB2AF21C7383D435298299AF2D84AD8ACEF22926533AB78C5867E988412E2CAA5C70402EA24DA3BA1A9C6E341D519B6A5720608CD25A30A5F121F0B3A54E6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/player/5e928255/player_ias.vflset/en_US/base.js
                                                                                                                                                                    Preview:var _yt_player={};(function(g){var window=this;/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. (The MIT License).. Copyright (C) 2014 by Vitaly Puzrin.. Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,. FITNESS FOR A PARTICULAR PURPOSE AND NONIN

                                                                                                                                                                    Chrome Cache Entry: 766

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (715)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):50702
                                                                                                                                                                    Entropy (8bit):5.373070303650078
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:Ifd/sRuiALPAavkj70bI5D4nDltOC2B7F:IfdURZGvkjob44J8F
                                                                                                                                                                    MD5:44CA3D8FD5FF91ED90D1A2AB099EF91E
                                                                                                                                                                    SHA1:79B76340CA0781FD98AA5B8FDCA9496665810195
                                                                                                                                                                    SHA-256:C12E3AC9660AE5DE2D775A8C52E22610FFF7A651FA069CFA8F64675A7B0A6415
                                                                                                                                                                    SHA-512:A5CE9D846FB4C43A078D364974B22C18A504CDBF2DA3D36C689D450A5DC7D0BE156A29E11DF301FF7E187B831E14A6E5B037AAD22F00C03280EE1AD1E829DAC8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/web-animations-next-lite.min.vflset/web-animations-next-lite.min.js
                                                                                                                                                                    Preview:/*.. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License... Copyright 2016 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,.

                                                                                                                                                                    Chrome Cache Entry: 767

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 2560x520, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):22017
                                                                                                                                                                    Entropy (8bit):2.393402761741637
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:yDS5X1yo0XxDuLHeOWXG4OZ7DAJuLHenX3RZTdJATPbTPbTPbTPK:S6X1juERAdfATPbTPbTPbTPK
                                                                                                                                                                    MD5:598EFD395C4596A5F0B48BFADF918A84
                                                                                                                                                                    SHA1:C32EA8406DE7742007FDDF2B8C0035318F63772A
                                                                                                                                                                    SHA-256:DC5B9CB12D4293961921B0966A5C5D1217DCEEEA689D8DD762B9F6DE3D4B8CE5
                                                                                                                                                                    SHA-512:FAE9463290F026CA4419B81190483EB41B126CC8D9A38323D9D8E6DD28B03FA8DB2BD4AA80EDB62516E0B5A2F04C58D8FB8F4466477D9B9E9BE880D4056E22AA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.gstatic.com/youtube/img/promos/growth/dc5b9cb12d4293961921b0966a5c5d1217dceeea689d8dd762b9f6de3d4b8ce5_2560x520.jpeg
                                                                                                                                                                    Preview:......JFIF.....H.H.....LExif..MM.*.......i...........................................................8Photoshop 3.0.8BIM........8BIM.%..................B~..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................................................................C....................................................................C...................................................................................?.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

                                                                                                                                                                    Chrome Cache Entry: 768

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):159
                                                                                                                                                                    Entropy (8bit):4.915607757159961
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHC/TFicZHLpsTLXcA1:tI9mc4slhohC/vmI4CbFxIcK
                                                                                                                                                                    MD5:D4FE0331328D6ADCB2D4B88D0996420C
                                                                                                                                                                    SHA1:BF668E3964C3BCD702650BB20E28FD303296124F
                                                                                                                                                                    SHA-256:616130E8A2BE44E0FDCFA1D3C7661172F2FED1471597820F8A3CAF01F4FBE2DF
                                                                                                                                                                    SHA-512:16DA047FE96F9808AF68EF19E64736114FD3620127964A86973A86401375E128CA99F6C937D1123AE4FD10EEE5079B24BF6C721028582EDEE37176254EE5E3D9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_left/v8/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M14.96 18.96 8 12l6.96-6.96.71.71L9.41 12l6.25 6.25-.7.71z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 769

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (22524)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):294818
                                                                                                                                                                    Entropy (8bit):5.492396709651441
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:07jNLPGMZQWy3wmTDxk4V6LtAbRslGAseiZPkUtWH+DxeFnQbPfrqm5v6jfXzC:07hLPGMZQrjVkt+2YAqTeaqm5z
                                                                                                                                                                    MD5:2173F6185EE0E933E265574D2433652C
                                                                                                                                                                    SHA1:FD6D1513B966238ECFFF1CA31FB0938563E104BE
                                                                                                                                                                    SHA-256:91A8D9D6A28B99496EFEE03FB82D3388A2EA86EFAD9F249924598C90FC261637
                                                                                                                                                                    SHA-512:306AB26691BA4C988C19CB5E4017DF24A18514CB5534A8D4F95B9BD26AB71C5B9C32B6CF8ED01B008DA01110E1A1C740B08EB2637CAAD929109A8CB1E81C3905
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3iJOM4/yf/l/en_US/cj-WhGwOS8kUnxMlViafIUxobY1SISQAaU7Ux1T2N87QDYvatkvPhoOSbRrfbUqJK8BKMhZHpfyu58FuOSNl1BbT1Rdzuzi16ygGc1wa-Oq19cevyCvEVQbD2OmPobANp9KHpDnYRWx5vjUlU_6SmVEaVrlFSHhTt9z8sp55HfXW__mMgFRlCsGN0FHzi95_wmB-51YxoStyBz2gEaogygfp_uoh2pEQn4HVER6y-GdB52bvQ0.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometContentArea.react",["CometSection.react","react","stylex"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i||d("react"),k={content:{alignItems:"x6s0dn4",display:"x78zum5",flexDirection:"xdt5ytf",maxWidth:"x193iq5w",minHeight:"x1t2pt76",width:"xh8yej3",$$css:!0},contentArea:{alignItems:"x1qjc9v5",display:"x78zum5",justifyContent:"xl56j7k",maxWidth:"x193iq5w",minHeight:"x1t2pt76",$$css:!0},contentCentered:{justifyContent:"xl56j7k",$$css:!0},fullHeight:{height:"x5yr21d",$$css:!0}};function a(a){var b=a.applyFullHeight;b=b===void 0?!1:b;var d=a.children,e=a.hasNoRole;e=e===void 0?!1:e;var f=a.testid;f=a.verticalAlign;a=f===void 0?"top":f;return j.jsx("div",{className:(h||(h=c("stylex")))(k.contentArea,b&&k.fullHeight),"data-testid":void 0,children:j.jsx(c("CometSection.react"),{className:h(k.content,a==="middle"&&k.contentCentered),role:e?void 0:"main",children:d})})}a.displayName=a.name+" [from "+f.id+"]";g["default"]=a}),98);.__d("CometNullState.react",["Com

                                                                                                                                                                    Chrome Cache Entry: 770

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):118498
                                                                                                                                                                    Entropy (8bit):7.984645486692299
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:/5D1a465q4dzvuVHaos3S4ZXfxLZ/N9pJFEUWBfnn:51TyzviHaosDZvt9Wp
                                                                                                                                                                    MD5:DBB08CBF2EB3F9ED9B87426C5BE69884
                                                                                                                                                                    SHA1:C1E6A8924F83D2FC34489B1CC98CA026198C38FE
                                                                                                                                                                    SHA-256:1DF7E53F66CE5EA567A1DA3B151EAB4E988B2A7603283019F30AE5F838592C2B
                                                                                                                                                                    SHA-512:BAABAA7AE47AA50CA8A504A9671DD429985FFF3FAFF5C8FD24B7662926892FC668A8B1D7647E2E307A2037AEB6EA5D92ACA79F936E12B45D4467B6E5BEF35973
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/419289594_397130502871602_1177489836597047833_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=i3ynX9-97-IAX9LIZ4O&_nc_ht=scontent-atl3-2.xx&oh=00_AfBo9SToZaVZDEMw5og3DplEsVdwQ-oAlDPkqlORoJhoXw&oe=65CECFD7
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100002a18000037480000bc490000294c00006ca70000c7140100071b0100d71d0100b4200100e2ce0100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..........................................................................................................0..@.C...........d.....d.................g. .@........@.......d........................................................................................................................................7.|..1.<..1.^......O.>..&.'....}M.A...g.<..6.}..{...+.w......../'..>U.C.|..k../..{....z..0}a..9..+........>u._:t|V&)...."....w...OC...R<....<.y.%..OY.r...-....?.zs..L.^....6q....G....h.._...K....x.>..qt.g.Z8P.............wQxc.......u.E......R........0.N.RC..Z.(.#.....!.t....m.d?7>...u......w.{.P.u....N..-.........!*....>w.......:....>q..<......>K....|.:...'..

                                                                                                                                                                    Chrome Cache Entry: 771

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1389
                                                                                                                                                                    Entropy (8bit):6.775311371182412
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:4q6PvPc1spEYH2pOhpNWuTrH/P7cFvQ14Mv/vapG5VhleO5+I:0PvPiWEmGOhpNJTbjTf/SKGxI
                                                                                                                                                                    MD5:AA34A7C07FBDD3893AE8A2A5E1B583B4
                                                                                                                                                                    SHA1:988640990D0143EB420F7760010FCA922C131B0E
                                                                                                                                                                    SHA-256:14B1618A1BC4DEC81875130BF121AEED634313F8A08F43E5EED9355E1FBD1446
                                                                                                                                                                    SHA-512:018C2DEF9717D1884A7B628FA911779C9137DB75989C12FCB68882F7624776D01267A839456807146F7B12207BCE301A22C0CF99E05079AF21B878A8761D1D7E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/357054938_660405059465450_8569690311302078310_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=Ho5vecrJ9e8AX-Covss&_nc_ht=scontent-atl3-2.xx&oh=00_AfA8hhdhHL2scSqSWeq8oqKidwOSoNH6qesaS-_HpCNVdw&oe=65CFCBF2
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM..........g..QJb3LUOTZDKtiGu94HS2..(.bFBMD0a000a87010000f00100005002000092020000cf0200006c030000e20300001d0400006d040000ab0400006d050000...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................8.K..\A.I...q>.)..&A....sr.|f>..#}m.p.1...+.YA.E.(......... .......................... 01@.............%5...........m.t.e+.N.......e....,......d.~.... ......................!...Q.1.........?.<...cw7.......6..$...p@..\Tt......................... 1........?..7&....,.........................!1A". #2Qa0@Rqr..........?..=*..#......N).,Oz..6...|D...CS.4 |..0..H4.G...8.lO..j.b.Q.L`<1m.M....d..<...:...v.s[..M...yf{x..e....#...$....................!1.QaAq.0.............?!.E.#Q......!..f..t.Gx...{..y..m.....)R..B|4D.V.;L..2..:.^.\...S.S......9....7........@..Q......A.8L>.......

                                                                                                                                                                    Chrome Cache Entry: 772

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):45702
                                                                                                                                                                    Entropy (8bit):7.971645914809824
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:hLv1P4d9/Br5wC+W9fGf7dCE000Gs+20vA0kl28I9mZ9EFBes1itwiJh+N6FgXXB:rG/r5SW9cd+RGs+20v9628IXFDQL+8MB
                                                                                                                                                                    MD5:26099CCCF30305F1201F8424B51D68D0
                                                                                                                                                                    SHA1:2AC4C1A4625716F7E2BEB64734B7711923B1717F
                                                                                                                                                                    SHA-256:6073584FFBC239C68CA1F88BAE02995A74B83CBCF86976C2EAA350D056C12B53
                                                                                                                                                                    SHA-512:9AA9663FB73CA8FC634F77E270F954DFD9FDDA7753A45CA3B7084A193B8F604355F61A9D33018FC9392AD4A6D96C76131DC2CF38257BE6A4F60AF3D38473CC9C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426387362_1105942407215375_2737749159521394573_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=XaaFhf_nMbIAX85AvZw&_nc_ht=scontent-atl3-2.xx&oh=00_AfAEd_b30N4mPNukzNRjmYNpQR1ssKmuNozkfjS3ArVv6Q&oe=65CF5A5F
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000c81b000023370000de390000243c0000d14600009d670000d66d00006d7200001077000086b20000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...................................................................................:.sf..GR.yx..j4......nt:...n4;.....9.O<.......yCo.o"3}..'.F.-.'....c]*Q..L...H.-2.-L.X.A.B.H5...p..9...\$rV..2.....7.=g..'.>.b.Y.'=X<..@.s.!..s......4....].....O.=^*y.E.Y.IP.P.I !.$4!.....`!.!....Y$...$$..C...s..d..<...3.[.x..=Z9(.j.F..l..p.eKw...>......EbI.H .jH .......... `....[$.BI.$...s.\...U.$@I..).$}.7.%..hE.....a..HV.b.k..b/..o.........E..`.`.`.`.`.`.a.I.$...H.!.....j.n.].L.,}.kj.-..}.r.!.u.t._...E.W..f|..*."Ue........TD...al....d....l...aq..Jap..9&,..HI $.;...Wr.Ms<..A])..v..o.i..?...^.H.m.`.....s...q.V]....J_;..b_......GV&........F@..9...at...!|...at...g4...I $.;...Ww.........

                                                                                                                                                                    Chrome Cache Entry: 775

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):14837
                                                                                                                                                                    Entropy (8bit):7.956802037494631
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:opU85g8wKMnF6aKtpEhcR3yYAtRAoW/0yjo:o95Pza+y+3ytRHW0y8
                                                                                                                                                                    MD5:07870D152D70D6F74B9E8D6A5BDFEB98
                                                                                                                                                                    SHA1:4EC2F3AA37C596B439E2E226BB4BABA2C19DF302
                                                                                                                                                                    SHA-256:7E48CD3F2CB4735AC47710E9F3E611A52A4E42693BDE2DD5825DA80FB340B6BA
                                                                                                                                                                    SHA-512:8A268B3177394EA082827C4BCF5FC697EF8EF6051E1D404E84ECEBD1C504593864E1FAC6ED0EBAA282E38DF22682F0DBCD1717A98262B315FEA1BA12FAD393D3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426448472_1133581194478056_1778681702203604223_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=-n7NeGuUGFAAX8ku8QE&_nc_ht=scontent-atl3-2.xx&oh=00_AfBlqPkkFvh043ZmFIMVHRFh9qgSz2n8jyVtzB3Gw6aMbQ&oe=65CE8191
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100006c060000a30e00001d1000003c110000d8170000f52200000d240000b22500002d270000f5390000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."...............................................................................g4y.7.u.k...H.]...9.z...$.$.q$.$..P79......k.l_..uq!w.;.f......i$.$.. I \....h.)%iw.:..$..].G".$.$.s......$..r..dd...... ..GW.$.$..w..@...w..A...e..E..{.^$.d..G.O..#.....;.DK.T.k...Z%C#WJ.f..oj.h.e..^.2.Ai.....U.g.6T,..<s.,..Q..3|d.".*_b.V....X.~.f....b.....:*;..2!.......NkI...#]....DU.WR.!q.....Ieh.)....v...<..}..3>`ET......o...3..v..ve'.+..E..n.C..g.....R.U`..<f.1;|^.3.7.1...e.].f[....4.My.]5.....I....k.Uaa....i.....eU=...5..Q.A.U..7J....g.2=3.8K[....[..2Y..:...ev..y.C$...xyn(.....)w.F.{..Z..f.....\Ual.mo.Y....|._9...M.).. .....D.t. ......c....]......"d.Vqkk]{_.N:.)..i...6..

                                                                                                                                                                    Chrome Cache Entry: 776

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (2036)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):39877
                                                                                                                                                                    Entropy (8bit):5.396884329936008
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:uwoR/ZrQgcREIb+9KiiqR12623vlpOeO/hpoLpRX:uz+gcRhQRIb9AP/hps
                                                                                                                                                                    MD5:EB4FBC0E01EB4A539A6BC202AFD4C644
                                                                                                                                                                    SHA1:1798B96F94E4461C211A1E5118994F6E0DFD53BE
                                                                                                                                                                    SHA-256:ACAE96AA93E083C150D041E2F01185932E5AACD71E4B433CD165DD41AA97103A
                                                                                                                                                                    SHA-512:B608780ED207A42DBE9DEEE88400A6D9462029A653CEC42323490B7023F210E99FB38BE5574A451F069EEB5A7F8125505989B331A2243C56D1F2C84A74A2B371
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/spf.vflset/spf.js
                                                                                                                                                                    Preview:(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof l&&l];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var da=ca(this);function ea(a,b){if(b)a:{var c=da;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ba(c,a,{configurable:!0,writable:!0,value:b})}}.ea("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,g){this.g=f;ba(this,"description",{configurable:!0,writable:!0,value:g})}if(a)return a;c.protot

                                                                                                                                                                    Chrome Cache Entry: 777

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):473
                                                                                                                                                                    Entropy (8bit):5.234511140442845
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:kxeXjxeX4wF4AigsobO4xlFhh0j4dXmVD7vDn/7R8kbRNfeX60:kMYDeAifobPxbh1X+bnTRprGJ
                                                                                                                                                                    MD5:0D9258B5F0F046B56B6E674923BADC12
                                                                                                                                                                    SHA1:1AF399B17773E759E96242419EC7885558A1A888
                                                                                                                                                                    SHA-256:12308E87A321E610E4BB0A127C93B188B2A1219B1BBB1D029E56474BE9D86A8A
                                                                                                                                                                    SHA-512:70A721885F7DF1992F5EA31884BDD51683D64428A64729E858DFBE18C82AD7C2BE6D9A3216B7A5F22AB1EBE60D5896367DF994058C3B7F4DF3DC54A3FE204F43
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=XiNDcc"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.WHa=_.y("XiNDcc",[_.tna]);._.k("XiNDcc");.var hJ=function(a){_.J.call(this,a.Ha);this.aa=a.Ea.Ty};_.A(hJ,_.J);hJ.Ba=function(){return{Ea:{Ty:_.gJ}}};hJ.prototype.bB=function(){_.i2a(this.aa)};_.K(hJ.prototype,"IYtByb",function(){return this.bB});_.M(_.WHa,hJ);._.l();.}catch(e){_._DumpException(e)}.}).call(this,this.default_AccountsSignInUi);.// Google Inc..

                                                                                                                                                                    Chrome Cache Entry: 778

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (10590)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):30877
                                                                                                                                                                    Entropy (8bit):5.570974663541533
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:8/86aj6dYxcJpu4MN0As67qVOqIfw85k2E8r8to8Tf48Wpe8KL8f7MiT8PtFvd:87aj5OJpu4MN0As6Hzsf4v8iTEZd
                                                                                                                                                                    MD5:794F65B58E42FF7B284DAA5F614A16F0
                                                                                                                                                                    SHA1:E1E5874FF2CC227A1092874C714EE77F52CFA8F8
                                                                                                                                                                    SHA-256:BDFA2087DF99C767C7B2CBF640F189619DA42A5593436701CEA99C26A56AA948
                                                                                                                                                                    SHA-512:32AB3014ADEC30285BB5EB4F339254897ED3F1556EA77B63522F1E85430EDD66165492E427BEFEF64CD27ADE8ADD7B0844D88B33A7DB9B8E8F9ABC773A90A480
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3iYu44/yf/l/en_US/FFT5PxPPkTj.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("GroupsCometMemberProfileLink_group.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"GroupsCometMemberProfileLink_group",selections:[{alias:null,args:null,kind:"ScalarField",name:"answer_agent_id",storageKey:null}],type:"Group",abstractKey:null};e.exports=a}),null);.__d("CometDisabledContext",["react"],(function(a,b,c,d,e,f,g){"use strict";var h;a=h||d("react");b=a.createContext(!1);g["default"]=b}),98);.__d("BaseHScrollConstants",[],(function(a,b,c,d,e,f){"use strict";a=1600;b=10;f.MAX_CONTAINER_WIDTH=a;f.WIGGLE_ROOM=b}),66);.__d("smoothScrollTo",["ExecutionEnvironment","UserAgent"],(function(a,b,c,d,e,f,g){"use strict";var h,i=c("UserAgent").isBrowser("Firefox");b=(h||(h=c("ExecutionEnvironment"))).canUseDOM&&window.matchMedia("(prefers-reduced-motion: reduce)");var j=b&&b.matches,k=(h||(h=c("ExecutionEnvironment"))).canUseDOM&&document.documentElement!=null&&"scrollBehavior"in document.documentElemen

                                                                                                                                                                    Chrome Cache Entry: 779

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):41977
                                                                                                                                                                    Entropy (8bit):7.962413534658226
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:2asI2yZJgGi2qXh7Yfar+TESijZh3ScBVnqnAjSoPLKiXTQPZzkl8P:VjTgYqyfDTZiiggAjSJiXTGdki
                                                                                                                                                                    MD5:FCBB518F02B6252259F8AC781C33B17C
                                                                                                                                                                    SHA1:F335C8F25333CCB4DC5471B3DCA089805D822104
                                                                                                                                                                    SHA-256:A1184E582866FA9FF05B1830D7EC0CB27AB5C9DA52CBCD371325D4553ECCF1EE
                                                                                                                                                                    SHA-512:D1D820D99BB8AF09DF127452DB1F240C19C848603F7B4C9FAB2224C4D119BBAD8F6D84103DE7C23942AF7D312D418CCE714F6D9E8FAD69AD342B937C4728C940
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426011781_730884609190826_7132036475637150156_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=xOqWO7ZlcvQAX-V36Uf&_nc_ht=scontent-atl3-2.xx&oh=00_AfDyHESn3Xt7m5oSPe0PTtjOE63kCXRDp82-v5cvq1_f1A&oe=65D00CFE
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6e01000003190000f7300000963200007b340000803d00001c5d00005b630000b8660000056a0000f9a30000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."............................................................................. c`....10........b..`...0..........L.....@.*.[.#!.3......W.i.......0@.0.`.L............4+....di....Yy....p.....d!..}P....C.0....4....1.0........(..|.q*........,. L"I.`...'....z.(..........@`.4...A.........3.K.T.".ib.$..#".3...c..B.$...y..!b0.M:C@............i..4.........0s......\.lD0JA..I!)"*ia.Q...f.....L............... .............C@.!..!.....$..$.R.)...uZj. ...........L......@.......3..!...(...!."H I.RK.$EI.6.........5.@.hb`....P........2..3.`.@N........IDT..I`.....@..........M@.i..........i..._@.....V_.....i.{R..6.m4.P`..%$EI,T..u.4&.........$........@........../......gS...[a../..x'.I.?.G.9.)A.)(

                                                                                                                                                                    Chrome Cache Entry: 780

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (3367)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):30283
                                                                                                                                                                    Entropy (8bit):5.534486329463991
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:Tsez1EDyQebe0dmjHyc+Rs23g/+MBT3wPKKbxI6TrSY6r4R8:opT0EjF1l3rq8
                                                                                                                                                                    MD5:6B55444EDA990F6BBCA3B8307C8B3655
                                                                                                                                                                    SHA1:9ED5D8270BDF1C108E5B19635EA636E19012715B
                                                                                                                                                                    SHA-256:B7C12450BD6D9C4EEEF41B1B54947395D97C65C686DD3E78B79EAE280915D79D
                                                                                                                                                                    SHA-512:D03151996C4F7C546678913DEA862F036085989D96D3DD3ACC78AD2D2883535BAB65C4A220D731E6FAFA0901D82E1D73E1598851E400E661ABFCB7AE73CC2981
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3iMz64/yd/l/en_US/hZiNcCSeLvF8PlOGv1TSr2.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("FBReelsRootWithEntrypointQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="25586853670913735"}),null);.__d("FBReelsRootWithEntrypointQuery$Parameters",["FBReelsRootWithEntrypointQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("FBReelsRootWithEntrypointQuery_facebookRelayOperation"),metadata:{},name:"FBReelsRootWithEntrypointQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometTahoeSidepaneDialog.react",["ix","CometCircleButton.react","TetraText.react","fbicon","react"],(function(a,b,c,d,e,f,g,h){"use strict";var i,j=i||d("react"),k=32;b=16;var l=k+2*b,m=16;function a(a){var b=a.bodyAspectRatio,e=a.children,f=a.onClose;a=a.title;b=b!=null?j.jsx("div",{className:"x78zum5 xl56j7k x6ikm8r x10wlt62",children:j.jsx("div",{style:{paddingTop:"min("+100/b+"%, 100vh - var(--header-height) - "+l+"px - "+m+"px)",position:"relative",width:"min(100%, (100vh - var(--header-

                                                                                                                                                                    Chrome Cache Entry: 781

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):66412
                                                                                                                                                                    Entropy (8bit):7.996701336118322
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:1536:/Se07GxuWAsA+WG9goIWen2z5hawCGEI889l:/Se0S9lAvG9goIWmhI19l
                                                                                                                                                                    MD5:1C1238920EAB6EA6357E27DC9DE7675F
                                                                                                                                                                    SHA1:5A08FB06C2E101EE6BF1E01A996101C134CEB02E
                                                                                                                                                                    SHA-256:EC3525BD1B87C8A43C1C526C2F6379BEFAC75089BC372F5CD35B56E49F61833F
                                                                                                                                                                    SHA-512:E9B07CFD9AE7F25A2A77FA784E8269008F6B85AA8AC5554AA19943F91374B4E43A45F70D14B93F73E3918E18A536FB1B42CCB9FBAA7F83467C10F5260A7EDB3B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://i.ytimg.com/vi/Fv5aMItERHM/hq720_live.jpg?sqp=CJDoqa4G-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBbLiXJx7u6iSkztGuvTrhOjDxssg
                                                                                                                                                                    Preview:RIFFd...WEBPVP8 X........*....>Q".D..!&*.;....ck...H..............`o+........:vc..g....._..Z?.wo....}...._[..............k....V......{..}...#....\......O._........|......}.2O...>..C...OK.l|o.q./._.......w{>.......a.t.....w........._...=....|......o..........[.......L.........c...........................f..|.V......n0.u.n../p..,n.B..d...,.......91...a.=.@..K'p....5..9....4....Fu....D.H.)T.......Y.....P.SF#.qQ1|....W...ow..m.^...li..8.u..o......)]..w...#..W........c?.X...-..1.......\'/..B]..nF....+:.[....^V......Rl.....$=.....c..J.?!58..x=...?..D...}.l...**C..../.f[.>0.T1.~>0*(ycLgq..w..gmF..G;.)U.&.w..K.+".....).[.2./.;{lk.{.)<..x.7....iHz...G.fDt.g..4...o.*.`CI..B...Q....6.....I.........r.1.|.1.a..bTB.un......%.....k....KP.UvFab>.+...c..).6q.-....gz..Q..K=.6......Y.....5...<..K..,..3...pq.*b...A9..j.LE..Q...}.>..G....P..#4L.q+..*6s.K...n..........m.]..d..m*....Z.w\d.6u..5..K.F..o....\=.Gi...r~....dgMM.q.........Fw..2...C...R..

                                                                                                                                                                    Chrome Cache Entry: 782

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):60004
                                                                                                                                                                    Entropy (8bit):7.996923564612695
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:1536:7YxJGwqs7KwbcN0wnwJMUMCL2H0P+Dj/sXh9k/EMM:7Y6SKgFMK2Dj/gGEp
                                                                                                                                                                    MD5:E1305EED97A43BADE60A53B263393700
                                                                                                                                                                    SHA1:26DF5E6117B3B1FFFD9D86081F7A2051A617EFEB
                                                                                                                                                                    SHA-256:928E729B1FB8EF893055AAA4CF19CF232201718AF675443B24CACDBA9A84E454
                                                                                                                                                                    SHA-512:85EC60FFE6FA8167EB69673F707D0DEB6B82B4D4D2DC21D92A6E91089E58F2152CAAA6124DAF5C186618A9DA3DAA9C9EBF695D89DB8A1EDAA1CE68A6F935EBAC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://i.ytimg.com/vi/sxe8gFXUhsQ/hq720_live.jpg?sqp=CJDoqa4G-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLBFTqP3yM4EkR8UjOpl2PeBIqVNpw
                                                                                                                                                                    Preview:RIFF\...WEBPVP8 P...0....*....>Q".D..!".W.p..enc0...VU`..X...@c.....G..c..8.w..<.}......w...........%...._...............7.w.......=....x.#..........................:.#..............u....?..~..............S.w./._................;.6_...^....k...O.....|.}...E.................O................|..4...k...w..............W......0~....f...../.?...?{..}......s...=........\J...&(7..EX..L.D...0!...../.....+X.A.,..x.z^x..Q.>.;c....eKO...}~.u....1..}...Ug98..a&..E.J.....s#.}.w.....4.S.?K......z..~i.Y..\.>'}...T...=B.Ct.7.)=......g 5....*..P...n.B........&...<..P....A..(...[.u..?u....cs..........E.....N....k.3S~y].....D#v..A.(do...OC.m....j.N....7g.....A...m.|....S.o..T...cEQO.....Lm.$k.7y.IW.bQ.gw.........2..~.....sGIj.S.w.$.`....$.....'6d..L.s.d..~z|...*..+.....y....< .0..Mks..O....J9l$..>`..*o...a(.C.I......7..Of.....C...\b..3{..o...].Y...f..O.'..UM4.bK.E.36%..`....%)k......F./....l...!.....%.q\...%.L.q.............?z..z|..]..'}..\.y..)E.^.....:.\....

                                                                                                                                                                    Chrome Cache Entry: 783

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (4264), with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):4264
                                                                                                                                                                    Entropy (8bit):5.023352101476255
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:cMR3GqZFZlZuAwkQ29BR6WtFfH/2Ff8FfSiY3hUgxJu8OJ/:cxC3wkQ29XtEmgiUhUgxJu8OJ/
                                                                                                                                                                    MD5:9DEAE13C40798DFCA19BD14ED7039D60
                                                                                                                                                                    SHA1:4BA302A1435B094031E4F2E1BCE1B6198F0CF825
                                                                                                                                                                    SHA-256:CDAC5527DC3C1A9F38C6B00086B2A10B9E7EAA1E062314E548C1FA602D17BBBD
                                                                                                                                                                    SHA-512:95B093D926535FA9454E3776A3E219B61502CE67AA2E659175AE879133DD35A6EFA1BFDBE5B6D3E3DD8BA1F0663892B44FD6F21BE17FEFA9725A234DFF3C5D0C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/cssbin/www-main-desktop-home-page-skeleton.css
                                                                                                                                                                    Preview:#home-page-skeleton{position:relative;z-index:0;pointer-events:none;min-width:0;width:100%;opacity:1;margin:56px 0 0;display:-webkit-box;display:-webkit-flex;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;flex-direction:row}#home-page-skeleton.hidden:not(.layered){opacity:0}#guide-skeleton{display:none;background-color:#fff;width:240px;-webkit-flex-shrink:0;flex-shrink:0;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-flex-direction:column;flex-direction:column}#guide-skeleton.collapsed{width:72px}#guide-skeleton .guide-item-ghost{padding:10px;width:100%}#guide-skeleton .guide-ghost{padding:10px 30px;display:-webkit-box;display:-webkit-flex;display:flex}#guide-skeleton .guide-ghost-icon{height:40px;width:40px;min-width:40px;margin-right:15px;border-radius:50%;background-color:hsl(0,0%,100%)}#guide-skeleton .guide-ghost-text{height:36px;width:100%;border-radius:8px;background-color:hsl(0,0%,100%)}@media (min-width:792p

                                                                                                                                                                    Chrome Cache Entry: 784

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (5842)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):13005
                                                                                                                                                                    Entropy (8bit):5.385476614866472
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:EGPzF/Z8FjmrWX8oDfc/xkiF55npVKyGT5xRNElQQx0JLNThA+dW51So:Bj8FarWX8oDfcFFDnpVKyGdxRNElB1Ye
                                                                                                                                                                    MD5:E1AD4E3D26CC72E49609FCAD39B4AABB
                                                                                                                                                                    SHA1:1D353A2E2E9C24C12A938C9EC8DEC48D87C6C420
                                                                                                                                                                    SHA-256:9AE20AB072694E627FC333C4514E5429B8BF47477F3886D9D0BE00FA5DCFDCAA
                                                                                                                                                                    SHA-512:5B7026F39184ACB8CFCBFA4C5528595F209A97E3F2FEFEA752BCAF6D0922A719EAD8706A3C8C42D37EA364B3E9CBACE687D72B0D1BAF614B690D0B14515C45C0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3idBq4/yT/l/en_US/nYVb1eL2wQQ.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("BaseToast.react",["BaseInlinePressable.react","BaseTheme.react","BaseView.react","FocusRegion.react","focusScopeQueries","react","useCurrentDisplayMode"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||(h=d("react"));b=h;var j=b.useId,k=b.useMemo,l={dark:"__fb-dark-mode ",light:"__fb-light-mode ",type:"CLASSNAMES"},m={item:{display:"x78zum5",flexDirection:"xdt5ytf",paddingBottom:"x19yoh24",paddingEnd:"xpowjs8",paddingLeft:null,paddingRight:null,paddingStart:"xrxijuk",paddingTop:"x6enp1t",$$css:!0},itemText:{flexGrow:"x1iyjqo2",$$css:!0},link:{wordBreak:"xdnwjd9",$$css:!0},root:{alignItems:"x6s0dn4",backgroundColor:"x1wkzo03",borderTopStartRadius:"x1192kqh",borderTopEndRadius:"xjfsc2c",borderBottomEndRadius:"xg8fqjl",borderBottomStartRadius:"x1kdh5me",boxShadow:"xi1c1fh",display:"x78zum5",flexShrink:"x2lah0s",maxWidth:"x1cs6qxi",minWidth:"x1hqenl9",paddingStart:"xuv3zuj",paddingLeft:null,paddingRight:null,paddingEnd:"xd3owfx",paddingTop:"x192rfv7",paddingBottom:

                                                                                                                                                                    Chrome Cache Entry: 785

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):3130
                                                                                                                                                                    Entropy (8bit):7.865766721634493
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:rpL83WmmdI+3aeWJPohWEDZ0ZEvMU3ZSBLToajIIkK:rV8M3aQWEDacMUINToq9/
                                                                                                                                                                    MD5:7E43BE9274860B429B32692073D25159
                                                                                                                                                                    SHA1:5A0F89B4165DDD2C2779E2D49906CB2C4E15F26D
                                                                                                                                                                    SHA-256:29426377BC09FF9D27AA3A037D29D9AED7505C4C21A0E13A27EBE405074256BA
                                                                                                                                                                    SHA-512:8E49B89CD4FA2B4FC8F7095411C726F60BAA64F40F25C522B01F98A10C4AB03874C60EEFAA7C9DF325D5D5BE15EC2D4FA5D5B6681C72FF2B85166BF502E65A25
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://yt3.ggpht.com/GjDLYFGF4IQaUobUK-6q3nOsU4o8fRMl4XgVipPWRqdRVt61s2LqgnbBXu3-qYL4Ab2xsfVo=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                    Preview:......JFIF......................................................................................................................................................D.D............................................5..............................!1"2AQaq..#$C.%3Bb.....................................=.........................!1.AQ.."aq2....B....3CRSr....bs...............?...Z.&.."h..&.."h..&..".m.f..%E\....O......|.T..^......;Z._P.4y....ry.*P=...c...~~....c.c.Y...F?M...._.r.W..../.o. ..Nh.|..........2...F.k6.&g_........~F..#d..Q..e.9.D..B$..:s...kT._..n,p..SL..!x.Wj&.8...2.O..^6 ..d2...1.pO....`.F.3....'X...t..5m^......G..h..&....v.~..A..LP......p.G.'.....Hl.h..q.p[Q[.g..cf..|.>f@.dL.[...].Y..`..D....:.t.L.......v.n...T.lJ..U"M....g..../"..?....8O...+.;.lh..k.".}...t.`H"=..w...*.....EG1.Nf.l6.`..U.^x...+....{......F..]IoZ..6V...<.4.."A..j....M...w)....0.E...e.......~....:..$....g.%.I...;....V.8..|.U.F.Ay...=.].~..`.......v./*.............B.s..]v.v,1>7....{.....\b.

                                                                                                                                                                    Chrome Cache Entry: 786

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (775)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1479
                                                                                                                                                                    Entropy (8bit):5.331655757916403
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:kMYD7xdu06qraNzvbY3Xaut/HTe93HyNP6Iz2hLb5BCo0SGbtEGbQdrOgM8Z4prw:o7xQ06dsXa8e9HsShPCSGbtEGbMN5ZW8
                                                                                                                                                                    MD5:ACD427B5E8D40A6A259595E97AA20988
                                                                                                                                                                    SHA1:6C822109080423888F80E905B8044F2F60435968
                                                                                                                                                                    SHA-256:21DBC6D5229FBFDD9055B0C9828D76D4FEDA69DB331522F9FDE9CE1ACEA74288
                                                                                                                                                                    SHA-512:FE59D1AB2ACFC6BAF487F1FAAD64CD9AC47D0F93018673E68E337BE777E53D882B65EA865242BA615733E1BC9D5D8ABA473A05308341CA1B482DF6CBC51C49C1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("kMFpHd");._.sTa=new _.gl(_.Cl);._.l();._.k("bm51tf");.var vTa=!!(_.Mg[0]>>20&1);var xTa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Fa=e;this.aa=0;this.da=wTa(this)},yTa=function(a){var b={};_.Na(a.cN(),function(e){b[e]=!0});var c=a.yM(),d=a.RM();return new xTa(a.AJ(),1E3*c.aa(),a.jM(),1E3*d.aa(),b)},wTa=function(a){return Math.random()*Math.min(a.ta*Math.pow(a.ja,a.aa),a.Ca)},VE=function(a,b){return a.aa>=a.ea?!1:null!=b?!!a.Fa[b]:!0};var WE=function(a){_.I.call(this,a.Ha);this.Bc=null;this.ea=a.Ea.ZP;this.ja=a.Ea.metadata;a=a.Ea.f$;this.da=a.ea.bind(a)};_.A(WE,_.I);WE.Oa=_.I.Oa;WE.Ba=function(){return{Ea:{ZP:_.tTa,metadata:_.sTa,f$:_.mTa}}};WE.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Bd()))return _.Ul(a);var c=this.ea.aa;return(c=c?yTa(c):null)&&VE(c)?_.jsa(a,zTa(this,a,b,c)):_.Ul(a)};.var zTa=function(a,b,c,d){return c.then(function(e){r

                                                                                                                                                                    Chrome Cache Entry: 787

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (4630)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):23276
                                                                                                                                                                    Entropy (8bit):5.4058301544742084
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:bBQaRLRCHqNBPDqYaqr70r2vZpJg8qv12XikJyJpXZ:bzLRCKNBeYdX0r2vJZBYTXZ
                                                                                                                                                                    MD5:BE18A2FAB2FE2BDE11191747F3D1FDFC
                                                                                                                                                                    SHA1:D2F1AF8A01A22DC69AA3452448AC63F48A7736A7
                                                                                                                                                                    SHA-256:45D96D32C9697EE2721F7EDBAFC9E0C7E5D78E9FBC6D8DC71467455E8BBD6FC4
                                                                                                                                                                    SHA-512:01FF62F16DE71965DB14D3C2A55F57411C744D5D6487D465CF4A2CD4202BF979CE6A6D660B81E6E475E79406800519D0C521D8F6E2C0C2238AABF301143A762D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3ib3v4/y8/l/en_US/gbdzDISzziB.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometInputWithCommands.react",["CometComponentWithKeyCommands.react","CometKeys","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||(h=d("react")),j=h.useMemo;function a(a){var b=j(function(){var b=[];a.enter!=null&&b.push({command:{key:c("CometKeys").ENTER},description:a.enter.description,handler:a.enter.handler,triggerFromInputs:!0});a["delete"]!=null&&b.push({command:{key:c("CometKeys").DELETE},description:a["delete"].description,handler:a["delete"].handler,triggerFromInputs:!0});a.up!=null&&b.push({command:{key:c("CometKeys").UP},description:a.up.description,handler:a.up.handler,triggerFromInputs:!0});a.down!=null&&b.push({command:{key:c("CometKeys").DOWN},description:a.down.description,handler:a.down.handler,triggerFromInputs:!0});a.tab!=null&&b.push({command:{key:c("CometKeys").TAB},description:a.tab.description,handler:a.tab.handler,triggerFromInputs:!0});a.esc!=null&&b.push({command:{key:c("CometKeys").ESCAPE},description:a.esc.description,handler

                                                                                                                                                                    Chrome Cache Entry: 788

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (18915)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):43237
                                                                                                                                                                    Entropy (8bit):5.680707641754852
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:5RWw2BBHWtPd0h3A4LWhNzrXNAtU9ArbM+AI99yNIE:5QBZWtmw4LqPXNIU9ArbMP
                                                                                                                                                                    MD5:A20A57297296210AE55C26306436FCE5
                                                                                                                                                                    SHA1:AF8363C369F8FD23868093CE0FF02C8D88C229C0
                                                                                                                                                                    SHA-256:2DE52103B1FEEB037AF1757A1D10CB77A335258410AFF50F3CC4B93589357FDB
                                                                                                                                                                    SHA-512:E0BD233E5F75ECCC4D5018E1F7A4650D13BDD84D4DDCBB1BF482CB35CC836B85CE146F0A2B41DEA578CECF05FB8E7A6C9B6F28DC79A81801A9898B700860020C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yY/r/YT7n1sgH1lv.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/../**. * License: https://www.facebook.com/legal/license/t3hOLs8wlXy/. */.__d("bignumber-js-9.0.1",[],(function(a,b,c,d,e,f){"use strict";b={};var g={exports:b},h;function i(){(function(a){var b,c=/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:e[+-]?\d+)?$/i,d=Math.ceil,e=Math.floor,f="[BigNumber Error] ",i=f+"Number primitive has more than 15 significant digits: ",j=1e14,k=14,l=9007199254740991,m=[1,10,100,1e3,1e4,1e5,1e6,1e7,1e8,1e9,1e10,1e11,1e12,1e13],n=1e7,o=1e9;function p(b){var g,h,x,y=a.prototype={constructor:a,toString:null,valueOf:null},z=new a(1),A=20,B=4,C=-7,D=21,E=-1e7,F=1e7,G=!1,H=1,I=0,J={prefix:"",groupSize:3,secondaryGroupSize:0,groupSeparator:",",decimalSeparator:".",fractionGroupSize:0,fractionGroupSeparator:"\xa0",suffix:""},K="0123456789abcdefghijklmnopqrstuvwxyz";function a(b,d){var f,g,j,m,n,o,p,q,r=this;if(!(r instanceof a))return new a(b,d);if(d==null){if(b&&b._isBigNumber===!0){r.s=b.s;!b.c||b.e>F?r.c=r.e=null:b.e<E?r.c=[r.e=0]:(r.e=b.e,r.c=b.c.slice());retur

                                                                                                                                                                    Chrome Cache Entry: 789

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 21464, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):21464
                                                                                                                                                                    Entropy (8bit):7.991635778215233
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:384:kNMw20ZcZdIR049weTGXkBXju/W4irYjhPC09oOtbMDa9HVZycTvwxNTGup:UaxmXXSdiQPCjMvyugNiup
                                                                                                                                                                    MD5:923A543CC619EA568F91B723D9FB1EF0
                                                                                                                                                                    SHA1:6F4ADE25559645C741D7327C6E16521E43D7E1F9
                                                                                                                                                                    SHA-256:BF7344209EDB1BE5A2886C425CF6334A102D76CBEA1471FD50171E2EE92877CD
                                                                                                                                                                    SHA-512:A4153751761CD67465374828B0514D7773B8C4ED37779D1ECFD4F19BE4FAA171585C8EE0B4DB59B556399D5D2B9809BA87E04D4715E9D090E1F488D02219D555
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/googlesans/v14/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2
                                                                                                                                                                    Preview:wOF2......S...........St.............................*....`..~..<..u.....H........6.$..|. ..r..K..........V...@yF#b...>.[<;P..@*.....OINd(...T...C..T.w.s.b..$.....6+. ....R8E$..o..f."MD.@T"...fH..fX..O....AA..F*....+v.Q(KpXF..U"..x@...3|l..E..<.O..~..5M}.".q.#Y9....c.o.s...M.Cr..Dt.,..CtI.O..{D......H..*.+>*K..:.Y..-.l.v......'.....^.Y.k..E..c..~..S..P0.@.....<.!(.P.u.g.2....y..y..Z...v.^..lu.dC.a..o....{.o....h3A.K.I..-.O,..}.c>....Q1]....($..........s..b.X..........CJ.+..4.gE4T.S.*{g......(^...bA,...~..R..p...<G."..y.G...k..*'...i.u....I..S....\.......e$..m.2...{K........V......{me.%.}...P3...{.T..i..Av...K..g.... ...R..n..{m....t@Z....1A.H.2...^..R5)..4}..(...T......=...Pg...Y....y..e.$...]U..0.....8..Fs.(..O.....&..f,g..5..1.yo9..:cy...e..A.......i...i...G..4`)..#j.<+..{ai..[..[~.(,......X......3.f.m+3...B......_D.F.X.i.Y#.X......}_.d..`.i..i......T...7v..A.......?..c..~..g..w.D.H)%..B.!.......:.....ZE{........m.FN.....k...0.X...

                                                                                                                                                                    Chrome Cache Entry: 790

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:PNG image data, 189 x 181, 8-bit colormap, non-interlaced
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):7289
                                                                                                                                                                    Entropy (8bit):7.85997289674361
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:lCRDz8VAQEISzCSFRqJwUaAJN7VK97XN+3xii36e:lUq4IeJUN5K97NgN36e
                                                                                                                                                                    MD5:E8D1B4455B9ED73DABB444AF813E0FD7
                                                                                                                                                                    SHA1:FD99452B6FAD2E0D3C39FF17787A1849D3BB3CB7
                                                                                                                                                                    SHA-256:B6D482EC59580B5BF80DAEC00E55656212867ACB26F09A0BB6173AFA3C45C4DC
                                                                                                                                                                    SHA-512:4B7F5E5F9AC922A3EA337E3C50A2487BE41189AE92D3CA299E702815A7882116F07B8E9EAAB812C4A9986EA0186264A6613D531189438FF105458188FB323A9F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yd/r/WfXPMghq_2a.png
                                                                                                                                                                    Preview:.PNG........IHDR.............=Z.o....PLTEGpL...........................................................................................................................................................................................................................................................................................x..........5@T................................................(((.............................................................v.............................w..........................w......................................x............................... ...v..w...................................................................................w..w..w..w...........v.................x..x..w..............w..w..y..v.................w..v..w..v..w.....w..w..w..w........w............./..q....tRNS........>..........H.8Z......f...0.d..p$.P...~..v..*M....^.,.TF&6.....kB~a.\:.......xrz..,.?"....<.J..5......@. .mW..~..........J..2.P.z.4s....@1......Xa(...hF.R...e.

                                                                                                                                                                    Chrome Cache Entry: 791

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):118622
                                                                                                                                                                    Entropy (8bit):7.997988938525759
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:3072:uj+GQHvcrPExCaE01glTzPZHRRCvLadHOlhHYKmD3EoRfrT:ulYvT45TzumQ2zzT
                                                                                                                                                                    MD5:C1AAE3F2A2BDE8C3B0DFC0FBC5B35EC2
                                                                                                                                                                    SHA1:522B13E366DF6F2D3B84054AE879D0514F152CA1
                                                                                                                                                                    SHA-256:387009F5ECD0238585B19B59B67A7D7D81584F3390CB9E8A0B410038B6C24DB5
                                                                                                                                                                    SHA-512:C578A63FA7FF9DAD9D0D5251330EEFB17B743E0941BCEC7C8F3342596EB8B3622CAA623F9C37AA9BBC346919D49A322AA7788E40F228B1BCCC56AFF8CE23DEDE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://i.ytimg.com/vi/gZd5YFq5TeM/hq720_live.jpg?sqp=CJDoqa4G-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLAWPOBmFM3HaNR3cdRiwF90H4VRlA
                                                                                                                                                                    Preview:RIFFV...WEBPVP8 J...P....*....>I..D"....&.(...3c....V..f..~Y.`..;T..a.....W.c.....G......+./.n......_..E...7.W.....?....C.w.......@...~.{..............?.~..........[...?..._..A.......{.....O...............w.?y.......T?........A...........?.{`..........~]..........g./..o....x../.?....m...O............?....7..............e...W................_.............S..........9.........K...g._.........o.....?.......}......?(.........G....._.......[.............q.C...?...............o...?....G......?t..?..?..._...|..y..-.vE.w'.OW..+....8.J;.t.=qI]S..#r{.~!n.b.m...TK........fw.OO2}.F/3....".Cy.....r....p.[.u...*I...<.....u!....+.K.,.s.t......h....*.$.y..#..e....z.:d_.Bv...y.JI...-#...lY....V> b..i...k...;.5.V.jUlJT.......0.B.Y....7..ly..........7P.......PC9.M.h#_.......)..jE/..(..H".*.J......./...#....US<H..Ex..^M.|.."m..8.4.s.f%u...R.F>...>....U.<....F-.2/.4./! >..(.,......xI..3..".w.KL...4....n..r.'J...".[b..+..T`.......:K.;.5?.4j....d.SSg..V...CG... ....,..&...W..L.w

                                                                                                                                                                    Chrome Cache Entry: 793

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x370, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):25319
                                                                                                                                                                    Entropy (8bit):7.972092170804397
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:Or1dAhh739xpZpw2B4laTHb0B0q2mPs38DZlZy9:kwJ39xRw2B4oTq2L81lM
                                                                                                                                                                    MD5:D6BFB9FDE2ABDF3C5F0BAF09E9F28166
                                                                                                                                                                    SHA1:9F7258B9BA702A2E996542DEA6B52330B256218D
                                                                                                                                                                    SHA-256:9F24A70799C849417074A3293AB1E71FCCC4FA445E0018CB1E619122C92E2CC9
                                                                                                                                                                    SHA-512:2E9A011D2827BC951A64569E9EF61A0957B95F640E03E296812E5E8BFC611F53BE7CD58C95BAEA69534AF92A65C0F2AC00B70E3DC508AF46E6FE44940B19E58D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/424982188_1562222731300154_4665361405575256852_n.jpg?stp=dst-jpg_p296x100&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=PSYQutJlPEUAX8P80kR&_nc_ht=scontent-atl3-2.xx&oh=00_AfBAf17F6e-datSAEyIq14R80PRqXNIkIiklqqTypWI7lg&oe=65CE6C9E
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f0100004f0900003a1600001b190000881b000093260000f8390000843b0000913e000071410000e7620000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......r.(.."...............................................................................=....;f....Z,.F`...xkm......|(/..?.W..d...........Z7.u.b..{.z~.}3.C^9....P....|..=.}>S...%..S......+v.^....C_Y....l.y.P..l\.....7.....o.....Kl...X.K....9.g......fV.W.s: J.6@..$wK|..W.m.z=.h.z....(C.J..Hrv.^.. ..kl...../S..z....'bvw9...d..T.J..3.[Vb...l.\.k..J.HP".RvRF..u.R.....@S-#.Y........>wt.W..._.Zm....H...K.>...Hr..M...Y..~:B..k|e....?".Y`.....e.Fx...X..ev..thX....t>.......\..U.h7<gt......2y.;s.Z..=..U....e.Oa.......$;AsyK9o.9s.Jg.ru.;E.r$..v.%#m..$Z.L.x-..V.J..u.S..9..W.k*U......-..t...<A.....t*..../..Y....`.9.)8'.~VDo.M.p5.TA.$...).MK.E..e.3....Y..C.`........#....-L.T..-.

                                                                                                                                                                    Chrome Cache Entry: 794

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):3815
                                                                                                                                                                    Entropy (8bit):7.884074888479033
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:8S6dxN6f4edt6y1IfamVrktwslsL2er5JZbRfJKNX7s2vaKKW:v6dxM6n5Vkt/sF5/b1JIr/v9KW
                                                                                                                                                                    MD5:70E21BAEA41EE5AF64546F713F268482
                                                                                                                                                                    SHA1:4C1A22E15DC25922B7E954803D5FB6D00D24E696
                                                                                                                                                                    SHA-256:6A5796C26992AD6ABAC70FD66FD19119B60CC20658ED08FF85D7DA49D7ED42B4
                                                                                                                                                                    SHA-512:EA16BBFD29DCA88CEE238F0B90809BD330E45A8D35890A703B49AD2F958F3C340220FB87364DAA7A04D470F55636E9EF7EE084E25A5DA52BCC4B6D703E0D6B87
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://yt3.ggpht.com/kDUg480xOHHjIEnvADRDAz8w9MapJEx-3UJjJQzfeg4O-SrAGHTOSpd5Tm5QtJi0RlSfafMxQg=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                    Preview:......JFIF......................................................................................................................................................D.D...........................................6.............................!."#1A..8Qv.$2Ba.9Rquw..................................>.........................!1AQ.."aq.24r......#..BRb..36ESs...............?..E.tQGE...r.f'c.....i......`........IIQ.H.h..?...p.......M...D.......e..|.?...C.y....W.s..*^......QY.m..f)..Q.E..Q.E..RC.u...........[5.V.T...I..!.,...b#..Q@.U,I....j]uYH']6....x.*..-.%)L........NG..b...jl........$.....S...2...R..0....(..).K~.d^./ mS....9.p}.........X...Toz.unNQ...S9.....{.[..h....).$...G~.ES..._U.G.....iW.s...AQm.Z..F.#.. ..M....&..2.P.J........Y../.T|....X....&y...a..p.V.-.5.q...:.n..N..rHY.#....;.F....~.{..q....N....F..{.'...BT....#mu..S.%.+....x...~.&..^..Z.^q./4Q...,lL....-.H.-..m...8.L.{.hU......8.s.o.,.....dW....e.+.j...y)...P.nI;(P>...wm..Z..Q....I.*..-*..+.....~

                                                                                                                                                                    Chrome Cache Entry: 795

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (645)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):11085
                                                                                                                                                                    Entropy (8bit):5.397976873792712
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:8losmj1Uqu+oCNLuZ08MnpAqntHMfG0v8X6JPRAkZE:JUEoCNLDpN8G0vDn9K
                                                                                                                                                                    MD5:CE762A9D30D6C70BB0516E8CEFC958BF
                                                                                                                                                                    SHA1:DA6CAC9C717DAA3A39F82F3421782C99EDD9329D
                                                                                                                                                                    SHA-256:A9FC343D602527A427E57671D021524A9FF5AF7B3DF1A58900A3B01057BDD8C7
                                                                                                                                                                    SHA-512:230753FBB26E90438DD43874D02FBBB1AD6DB9A0FE76DA978EA47A8CA06FC99DD5E475104ABB5DD25CE222423D9BDA7991FD0EE896386561CD6F9AC10F8932E2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/www-tampering.vflset/www-tampering.js
                                                                                                                                                                    Preview:(function(){'use strict';function n(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var p="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function q(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var r=q(this);function t(a,b){if(b)a:{var c=r;a=a.split(".");for(var e=0;e<a.length-1;e++){var h=a[e];if(!(h in c))break a;c=c[h]}a=a[a.length-1];e=c[a];b=b(e);b!=e&&null!=b&&p(c,a,{configurable:!0,writable:!0,value:b})}}.t("Symbol",function(a){function b(l){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(e+(l||"")+"_"+h++,l)}.function c(l,m){this.g=l;p(this,"description",{configurable:!0,writable:!0,value:m})}.if(a)

                                                                                                                                                                    Chrome Cache Entry: 796

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):251
                                                                                                                                                                    Entropy (8bit):4.807326238374636
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4slhLJ9hC/vmI4hLBIl/qVs+RLjUjUX:t47N9U/vmRYiVswfUjUX
                                                                                                                                                                    MD5:05A720716D71F9F56D6C0E5C4B47680A
                                                                                                                                                                    SHA1:D24611C11E8CC3B158EB518F2298D1E35CE03E48
                                                                                                                                                                    SHA-256:B90706D55C1E8B616BF8D677C195D09AF8AA75BC669BA3A36A25480CA86F6926
                                                                                                                                                                    SHA-512:D0DA0CCC993DB255F96AC9CCDDA35DAADA2928F17A1262F5954B6A3C54B57080544E5A9C3808275749ED15A118AAA9B44B50B0AD8A1F2BE668F9D7614A0456B1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/x_mark/v4/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m12.71 12 8.15 8.15-.71.71L12 12.71l-8.15 8.15-.71-.71L11.29 12 3.15 3.85l.71-.71L12 11.29l8.15-8.15.71.71L12.71 12z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 797

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1246
                                                                                                                                                                    Entropy (8bit):6.572644059810536
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:gqSPctyc1spK+l/FApUk16kgoMC1Hrx3GbgBPsP3UBDOzaMx:gwyiWKe9sb15t/BEPEYX
                                                                                                                                                                    MD5:3CAA41517EEF11098B904C11A2501057
                                                                                                                                                                    SHA1:10094215E5E422D8BF3365E2E523963C9E55000F
                                                                                                                                                                    SHA-256:76BD704FAB8DB436ADC6068B471D91092E89D1DED2E9F9D37112DB53244E55F0
                                                                                                                                                                    SHA-512:294E14BF78D1713640FB45FFED790E986EFED2321A0EECA5C4D1845D6EB5090DFA113AA547E72FE5B69416C0EE03C0FC98C8FA50E61C175B02A8677FC2E303EB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/291766230_105303815576426_610588707305446125_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=HT7DQsVwvR4AX9K2uJ4&_nc_ht=scontent-atl3-2.xx&oh=00_AfADPq0dZPf4JO7R3ZB9ir_8-TGrZwJZLj79yuyxQy3JlQ&oe=65CEFEA7
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6a010000bd0100001702000038020000750200000d03000092030000c2030000e303000012040000de040000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................v..."x..{.g7......fl".fH.......!........................... #01...............C.n.L.L<>_...8Bm$y.M!..b.P..k3R.Y:......#&..V.........................@........?.......................@........?.....0....................... !12...."AQa..#03Bbqr..........?..m.9."yq0...TQt....^..........;.k...!+A.*.....*.>.s.../'.,..[.h.w..4....gVk....$.97.e...g..DeF..G....%....................!A1Q. aq....0..........?!....+...X..%Q..1H.A.WIr.?.j...9.&B2.P......%-!......8.rF.fX..+v.._........X....qt.x(!.E........C...R.x...$.):...U...4#..................<..<!.<..<.....................@........?.......................@.....

                                                                                                                                                                    Chrome Cache Entry: 798

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):44541
                                                                                                                                                                    Entropy (8bit):7.954836071151923
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:abpmtjQubc7GKdhzQMXC1jVPXL0D6jK+Zlja+DxK/d1ZkQ8UiNoVnjMqK:Mpoj9c7GKTsMy15fLw62Wj7xK/d1Zkzh
                                                                                                                                                                    MD5:5BF089822B566AD5B5E42B9E9CC6A1F0
                                                                                                                                                                    SHA1:34F96A6856CEF65C1A8A3F2F8B8C88AF32BFF260
                                                                                                                                                                    SHA-256:BF90F6094B8B51F8DA9C05234459923AC0DCFC806AB4D8CCFAD2F2FB990E9CC4
                                                                                                                                                                    SHA-512:5320D7EC68EE580B9EB77454A461DB15E026B9A5CC5140F79222A6A1B4C98715E91CDDD498C1C888EDD5D6B85E5A5027C0733A4A62E1224C5A0C162D4E993D91
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/412973881_344180521680755_2530261897271283493_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=US0w3Zyy6IwAX93qjjl&_nc_ht=scontent-atl3-2.xx&oh=00_AfC2PeUaFFddHrY2K3k_nNNXLYxPLspg3cYZxSH211rzlw&oe=65CF5320
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7101000057180000953500006737000003390000605000001f6f00004e75000053780000547b0000fdad0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."..............................................................................................................................................................................................................."...........................................................................................................................................................................................................:z7.y...KZl...s.8...&K.0.a.....0.........g..........W..?..w...........nb..}...-..cy....u.5...t.....x..xA.y...m..{........<.{..........2.o......6..L\..=../........S.r..^..=O.p...!..S...w..3...y.|klz.^%.=J.s'.._...>.u....<C.....{..V...._..|..S..f..+9-.oXy.}._B..^..

                                                                                                                                                                    Chrome Cache Entry: 799

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (405)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1600
                                                                                                                                                                    Entropy (8bit):5.22150717502245
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:kMYD7uIXKNPxDD3HwAntYuTNPx3CBiW4TRxu9yNY6cumXu5yNPxqkphiJy1vc6y/:o75khJnXBVUeRx6yNH15s5u8c7Dvz+rw
                                                                                                                                                                    MD5:3BEA06F7C0C210A1B348F2E59D6F6E58
                                                                                                                                                                    SHA1:208E34B3B5E2DFC04459EF249C31F43EC71AED4C
                                                                                                                                                                    SHA-256:5ED84B73AF6CEE3C68FF6202BBB3BDDC5E42DC8B09EB02F2A518AA70068DC6D2
                                                                                                                                                                    SHA-512:9D517972EC785D712969BD6A65779824F0D5EF9C7AB5335CF7C4451776678ED4E29CA320FDAE192E6B637114F5623D94A2D42E0EAF905FD14D37234DE9E204E8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=w9hDv,VwDzFe,A7fCU"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("w9hDv");._.ng(_.Nha);_.Ew=function(a){_.I.call(this,a.Ha);this.aa=a.Xa.cache};_.A(_.Ew,_.I);_.Ew.Oa=_.I.Oa;_.Ew.Ba=function(){return{Xa:{cache:_.Wp}}};_.Ew.prototype.execute=function(a){_.wb(a,function(b){var c;_.ef(b)&&(c=b.Za.Ob(b.fb));c&&this.aa.wC(c)},this);return{}};_.yr(_.hia,_.Ew);._.l();._.k("VwDzFe");.var oF=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.Kq;this.ea=a.Ea.metadata;this.da=a.Ea.Bq};_.A(oF,_.I);oF.Oa=_.I.Oa;oF.Ba=function(){return{Ea:{Kq:_.PE,metadata:_.sTa,Bq:_.ME}}};oF.prototype.execute=function(a){var b=this;a=this.da.create(a);return _.wb(a,function(c){var d=2===b.ea.getType(c.Bd())?b.aa.Zb(c):b.aa.aa(c);return _.Lk(c,_.QE)?d.then(function(e){return _.pd(e)}):d},this)};_.yr(_.mia,oF);._.l();._.k("sP4Vbe");._.rTa=new _.gl(_.iia);._.l();._.k("A7fCU");.var UE=function(a){_.I.call(this,a.Ha);this.aa=a.Ea.WK};_.A(UE,_.I);UE.Oa=_.I.Oa;UE.Ba=function(){r

                                                                                                                                                                    Chrome Cache Entry: 800

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (5311), with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):5311
                                                                                                                                                                    Entropy (8bit):4.950469424497734
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:B2cQbeDaksUebwlobsiJtKDUCbO/7p3uyFu7BtumruJbubbugWHxdXW:XOkAxMHwC/
                                                                                                                                                                    MD5:81B422570A4D648C0517811DFEB3273D
                                                                                                                                                                    SHA1:C150029BF8CEBFC30E3698AE2631A6796A77ECF1
                                                                                                                                                                    SHA-256:3C8B38D9B8A3301C106230E05BEEEDBCD28B12681F22FD9B09AF9E52DC08635D
                                                                                                                                                                    SHA-512:1D4966A88D7CF6BE31B8F53547A12DB92CABB4C05176ABE995C75C8889765EC68B7210C3BE75F60954CEB2938412FBDEB94D4D25DDC927F3A89ECA76A84A9EBC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/cssbin/www-main-desktop-watch-page-skeleton.css
                                                                                                                                                                    Preview:#watch-page-skeleton{position:relative;z-index:1;margin:0 auto}#watch-page-skeleton,#watch-page-skeleton #info-container,#watch-page-skeleton #related{-webkit-box-sizing:border-box;box-sizing:border-box}.watch-skeleton .text-shell{height:20px;border-radius:8px}.watch-skeleton .skeleton-bg-color{background-color:hsl(0,0%,89%)}.watch-skeleton .skeleton-light-border-bottom{border-bottom:1px solid hsl(0,0%,93.3%)}html[dark] .watch-skeleton .skeleton-bg-color{background-color:hsl(0,0%,16%)}html[dark] .watch-skeleton .skeleton-light-border-bottom{border-bottom:1px solid hsla(0,100%,100%,.08)}.watch-skeleton .flex-1{-webkit-box-flex:1;-webkit-flex:1;flex:1;-webkit-flex-basis:0.000000001px;flex-basis:0.000000001px}.watch-skeleton #primary-info{height:64px;padding:20px 0 8px 0}.watch-skeleton #primary-info #title{width:400px;margin-bottom:12px}.watch-skeleton #primary-info #info{display:-webkit-box;display:-webkit-flex;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-web

                                                                                                                                                                    Chrome Cache Entry: 801

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):58260
                                                                                                                                                                    Entropy (8bit):7.996621028991795
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:768:xhhPBPNJCGqcAV5KkZoC9JXRl7avbWdjafnVeU9So/fd14Yak+VDNAeMZVx1Kb6h:ZBjCGqvwkZN9JXRwv6j0eUP1SUz
                                                                                                                                                                    MD5:7B6E448BC07B58C98E0A3B19CCA30090
                                                                                                                                                                    SHA1:B93DC691B0F9DE4DD8F9B4B6CE44B17979F90ADB
                                                                                                                                                                    SHA-256:393140DC447A8C2DD34A70AA5519F5C3F737F84AD72F9DD504A8CDB15C912F91
                                                                                                                                                                    SHA-512:37AF987D866869A26320E885A62194CAE0ED841037783C50FE69B35FC5638A75D2F8A066954BE3C9050180A5FC60E83F30B923B97176D9D10764F6DE9EF2E37E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://i.ytimg.com/vi/pRgGDf71FNw/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDcow3ItfXbkj2i417vwxK77wtOWw
                                                                                                                                                                    Preview:RIFF....WEBPVP8 .........*....>Q".E#.!..yk.p..el..........Z....5.....;.o..z.....B..?e...C.....~..o...7..,..D.rI@.l7...<.9........}@../....?..?...?...<..kK..V...._Z'..*...i...w...7>h.o]1.....l-.})|....?.^m.R...>.........G........S.?.?....S.7./`..?........_.{........{..I./...}?...............A.....?.........y}...7....._.....7...'........~.{k.+._./...?......7.......o....u......G..........d.....M|D....z...@......!..2.=)....7..h..........9hH.8T.MD.hx..8..}...F..o.~8-.w.cBe...U)NC......!\.m..K.G../e.{..].8.>....o.E.R.m.ye........(8A...`..9.C.....z.._...p.O.;n.0.3u...gM.e(...Lt&.....8c../.<fzi.P.<.u._.;5G........f..^8|.<..`H..=...F..(..g;...Wyi m>..u8.*..C.......F..m..E...Q@......K..2....]Zb.C.r........j.>..Q.6....#..n...3f...j.$...3...6..{S......rJ.l_0E..gH..+....n....@,..vT..&...4..i<a2....+...?..*.....[.Z._....M..1.{.r..[KO%....[v...\.lm...L....=..=.....?l...ou..[.Y.....=-.....a.W{....5.Y].,...wf......qO.....G../.......N.j........"6J.6.^-x

                                                                                                                                                                    Chrome Cache Entry: 802

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 21700, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):21700
                                                                                                                                                                    Entropy (8bit):7.989666631701204
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:PxbG/ZciREUTWlMwbptJm5f9/1HuLZ4r38bxSpfGL/+SHA+ilQlO3fq8O/4s:5bfiBWlRPm5fjrruYJGTiqlO3fo/p
                                                                                                                                                                    MD5:7D75A9EB3B38B5DD04B8A7CE4F1B87CC
                                                                                                                                                                    SHA1:68F598C84936C9720C5FFD6685294F5C94000DFF
                                                                                                                                                                    SHA-256:6C24799E77B963B00401713A1DBD9CBA3A00249B9363E2C194D01B13B8CDB3D7
                                                                                                                                                                    SHA-512:CF0488C34A1AF36B1BB854DEA2DECFC8394F47831B1670CAB3EED8291B61188484CC8AB0A726A524ECDD20B71D291BCCCBC2CE999FD91662ACA63D2D22ED0D9F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/googlesans/v14/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2
                                                                                                                                                                    Preview:wOF2......T...........T_..........................4..*....`..~..d..u.....,..$.....6.$..|. ..V..K..^.=...sp.f.m../....l\.....T.9.n..A...........2x.{P[V..v%..M...f.7..+c.cM.'...$..u.H4[?i.'..T..+.(...L...inV.@.dd....T.. }b...c.ghRA..I$.su.....`....Q.OB..S.{.#.3..o.{v.........n...]f#b.J_.......}# ..1... F........=?O.|._p........X.6.VQ.*.E..rU...}....dK.$...0.W..2i..Y...9.Y.............f{..6'....C:%.(........}.....W..._....k...|.........Y8./..e..........L......_.9..v...2F..$..y)....UWu_..T.]qE.H.b..OP...B@.4.!,F..._............z.3.*.A,h.M.(...6~_[U$.....uM2.*..qz.v.........hV\|?.......M-.h..by.A,.}.....?...52.g.,....<..s..k....h.U.]1.1..O......m......j...}6.j.v.a..R....Fj...).fO3........GSM....... ...GL..({A....$O..&'..\....:.x....{N.p8..q..iF..k...b.>....<..M..`.....d.I.5... .x...mo.L.?A(..F }./.._V.e.A.Z3.....C...h...f......(,..3....%.h'.?sG..&x..W.......b].'34.S#s...wiG.O....J.ADDDDBw.m;.....K.ti).....?.6.\.M..d.....[.z....4..D.b...6..F.....F..D.r

                                                                                                                                                                    Chrome Cache Entry: 803

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):369501
                                                                                                                                                                    Entropy (8bit):5.21130790357069
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:sci8ZHMKKtkSgV9UI3ILJPptpJKztM6oyi+MOn4y2Ox5juDEnXrDJc7MsByZ54cr:sci8ZXSggImSoyJufmJ3cSIoNN
                                                                                                                                                                    MD5:7C552A32C044942DEC1BB97C3145698D
                                                                                                                                                                    SHA1:64586079C211BB0E39E613976699BB2505171F5B
                                                                                                                                                                    SHA-256:FADE87ADB180B7D137C67F5C200574F11FB934A71D95B591EB40A26539A1E769
                                                                                                                                                                    SHA-512:C72A0931FB821334CEE331A39F578B7D8806F1195585038504F183C83C38CE61816EB59CD6B7FD1D369A960E1DE67B54C72E6461D209BFFAFBE2D9DCAD28BFD4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/player/5e928255/www-player.css
                                                                                                                                                                    Preview:@charset "UTF-8";.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-font-smoothing:antialiased;-webkit-tap-highlight-color:rgba(0,0,0,0);touch-action:manipulation;-ms-high-contrast-adjust:none;forced-color-adjust:none}.html5-video-player:not(.ytp-transparent),.html5-video-player.unstarted-mode,.html5-video-player.ad-showing,.html5-video-player.ended-mode{background-color:#000}.ytp-big-mode{font-size:17px}.ytp-autohide{cursor:none}.html5-video-player a{color:inherit;text-decoration:none;-webkit-transition:color .1s cubic-bezier(0,0,.2,1);transition:color .1s cubic-bezier(0,0,.2,1);outline:0}.html5-video-player a:hover{color:#fff;-webkit-transition:color .1s cubic-bezier(.4,0,1,1);transition:color .1s cubic-bezier(.4,0,1,1)}.ytp-probably-keyboard-focus a:focus{-webkit-box-shadow:inset 0 0 0 2px rgba(27,1

                                                                                                                                                                    Chrome Cache Entry: 804

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):473
                                                                                                                                                                    Entropy (8bit):5.234511140442845
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:kxeXjxeX4wF4AigsobO4xlFhh0j4dXmVD7vDn/7R8kbRNfeX60:kMYDeAifobPxbh1X+bnTRprGJ
                                                                                                                                                                    MD5:0D9258B5F0F046B56B6E674923BADC12
                                                                                                                                                                    SHA1:1AF399B17773E759E96242419EC7885558A1A888
                                                                                                                                                                    SHA-256:12308E87A321E610E4BB0A127C93B188B2A1219B1BBB1D029E56474BE9D86A8A
                                                                                                                                                                    SHA-512:70A721885F7DF1992F5EA31884BDD51683D64428A64729E858DFBE18C82AD7C2BE6D9A3216B7A5F22AB1EBE60D5896367DF994058C3B7F4DF3DC54A3FE204F43
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=XiNDcc"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.WHa=_.y("XiNDcc",[_.tna]);._.k("XiNDcc");.var hJ=function(a){_.J.call(this,a.Ha);this.aa=a.Ea.Ty};_.A(hJ,_.J);hJ.Ba=function(){return{Ea:{Ty:_.gJ}}};hJ.prototype.bB=function(){_.i2a(this.aa)};_.K(hJ.prototype,"IYtByb",function(){return this.bB});_.M(_.WHa,hJ);._.l();.}catch(e){_._DumpException(e)}.}).call(this,this.default_AccountsSignInUi);.// Google Inc..

                                                                                                                                                                    Chrome Cache Entry: 805

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 32140, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):32140
                                                                                                                                                                    Entropy (8bit):7.9941922772245
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:768:sWzfeCBJsfRau5EAgzQRLYxSjbminAOvb5oAqLR43U8u:sW6CB8RXraSj5nBqAqLgUR
                                                                                                                                                                    MD5:81AC05C6D01D84D913A56C11909CDC7D
                                                                                                                                                                    SHA1:55F6BD5429C5A35ED53CAAE2CD50D856EDCB7883
                                                                                                                                                                    SHA-256:B222B23C6EE94816389506D4DE8EAD66181C8053242E1E1EB784CCAC46BC7EE5
                                                                                                                                                                    SHA-512:0925243828F33130CB3B68A6A113F1AABD07A8B19B3B99F45E5A2B1B2473622FA997D833C1D4B7B71781F246154D3A145AEA37CDA5351DC851EB3F4E550677AE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/youtubesans/v23/Qw38ZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HO_T7fE.woff2
                                                                                                                                                                    Preview:wOF2......}.......=(..}...........................'...\...?HVAR.n.`?STAT..'*..,/\.....x.1..J.0..(.6.$.... ..&..d..[<+q..w.i...?..9f....w.s_R0......1.s...s...1.O...f.n......Xe.R.IJ.Y$e$QT....~d....Z...s.FKY].niUV.o..[...g.0.oX.....^..AQt.a..oI.yb....].s..?.{..-dZ.TyW..{..3.H.H._H".a.+....~=G....=l....~S...[s.o.U....bc.r.....{.{.A....3..". X.".......WV....E,.........*.b4Fc...o.g/\...(....|.|2.Q....Z...Vw.u.......#.....i..1......[...R....,!..B.%k4......p(...W~....*@].x.............k.$.LF=<n.?.Q....~1.M.......+..AB..D..b$...I..q...3.m.Y...v..0.=.....f....I!E~.%...S.].AY...........[..a.~.....&.!]..Y..,...\k.........L..q.n.3.Tf.}...PQ..B.z9.'.......p._7K..Dt.j.8.....}.._..+.....V3..At.=?D.^...$...@..q..q.GA..Z....P%.&[.+.4.#..:.K.-...dG.: L.^....Y.E.e.....L..G.jg.gf.Jv....^.....bs..).?#).G`........U._..h....AZ..6)Ga..p%.B_.... *.r.:.......eR.....eJ...J:9...|.N'.cS.0.......-..^..#.3.4L....(....g.OH1j ..!..O.~..@..j._W..APsr|l..Y+.;n..Z...M..w=.]).Y...$G'r.[..P

                                                                                                                                                                    Chrome Cache Entry: 806

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (826)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):8035
                                                                                                                                                                    Entropy (8bit):5.318512945699808
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:Td3BL/z3WKN4THrowJ7cKE03viAgdgF/dYiEyX3NSDg:jjnN4jrowJcKEw/gdgRdYiEk3Ag
                                                                                                                                                                    MD5:C8C34632BE75E5391C96E23353A594CC
                                                                                                                                                                    SHA1:D1D82CB6837896DD9CE510C1CF6AA25C486B6828
                                                                                                                                                                    SHA-256:E6E2886050EF8823F376B82E51DB52CA50FB6C51294577BCA31DAE39A1E884E2
                                                                                                                                                                    SHA-512:6FFA30B8A5E408F8DB640A007584172DBE85E8EC0715E03F2E0CE92E1C5D0CF291EFF8A7F0A3DE5552CE23EB739C795598A1ADFF95DEC3E88F8D79EB8F2D761E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.FKa=_.y("wg1P6b",[_.sy,_.Am]);._.k("wg1P6b");.var t_a=function(a,b){b=b||_.Ma;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);0<g?c=f+1:(d=f,e=!g)}return e?c:-c-1},u_a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},v_a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return u_a(b,a)},w_a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.ph&&!(9<=Number(_.zh))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a||a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?u_a(a,b):!c&&_.ji(e,b)?-1*v_a(a,b):!d&&_.ji(f,a)?v_a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Sh(a);c=d.createRange

                                                                                                                                                                    Chrome Cache Entry: 807

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (58866)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):121376
                                                                                                                                                                    Entropy (8bit):5.175919099327062
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:sLQpmW+m/KTYGu9AoaI/mQVzm75W8Zcz834SS40FGXUQvqO4pxuor3lQNO301J8R:ZI2eIgRZ0GQLv90/I9aCIqYOpp
                                                                                                                                                                    MD5:F6E8A4C83B454A18AC4E4E5E12D453D8
                                                                                                                                                                    SHA1:2DFEE0DB58D9F1636FDB0CD217AA577D34C6896C
                                                                                                                                                                    SHA-256:42D4259BAFCA973F747B89D317CBFC6212AFBB2A115152F61B5AEFA9351425DD
                                                                                                                                                                    SHA-512:2F3E9E582F5B16E0C19F0378F8408B8C3F0CB7E4075B378500A6D1618966F0FB8419C30C506F2BC3A49A00C297083A1C3F3C4F81E4B2AA44953C7AB40FD466FE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3iKvn4/yU/l/en_US/55wRPhP_vGj.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometUFICommentListRendererForCommentsAPITahoe_renderer$normalization.graphql",["CometTextWithEntitiesRelay_textWithEntities$normalization.graphql"],(function(a,aa,b,c,d,e){"use strict";a=function(){var a={alias:null,args:null,kind:"ScalarField",name:"id",storageKey:null},b={alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},c={kind:"Variable",name:"location",variableName:"feedLocation"},d={kind:"Variable",name:"use_default_actor",variableName:"useDefaultActor"},e={alias:null,args:[c,d],kind:"ScalarField",name:"can_viewer_comment",storageKey:null},f=[d],g={kind:"TypeDiscriminator",abstractKey:"__isActor"},h={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null},i={kind:"Variable",name:"scale",variableName:"scale"},j=[{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null}],k={alias:"profile_picture_depth_0",args:[{kind:"Literal",name:"height",value:32},i,{kind:"Literal",name:"width",value:32}],concreteType:"Ima

                                                                                                                                                                    Chrome Cache Entry: 808

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):6953
                                                                                                                                                                    Entropy (8bit):4.97426625305529
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:c3q9R1ETjY1k9kudJQphE2HcjHVSdDtIYIsFsiLQ96ziV:r9zEfWWkwJQphjHgkvIYJi0QF
                                                                                                                                                                    MD5:645F01C1901427F176085F2F984C6139
                                                                                                                                                                    SHA1:AA5E66A1B49B4840EF30B765712178DA237CD74A
                                                                                                                                                                    SHA-256:18D91A4732D34F80E3B785F0EE2F3FA5102582D5DA3BC44C76AFBCF87D5E4A50
                                                                                                                                                                    SHA-512:6913F0471E4510FC5B95A7317C2347B6B5835973BBFC5F51A28A9EC6AF2A29D67BEC4B4B1A434A19610F75A8547C584582FC690E5392B466D534EB5876BEAEF2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/search/audio/no_input.mp3:2f6fcabbd09240:0
                                                                                                                                                                    Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..`.................................................@..................................%trak...\tkhd....................`.................................................@...............mdia... mdhd.............D..`.U......"hdlr........soun.................wminf....smhd...........$dinf....dref............url .......;stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts...................(stsc...................................tstsz...............................................................{...q...h...d..._..._...W...^...b...U...K........stco...............|....udta....meta......."hdlr........mdirappl.............oilst.....nam....data........cancel....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 0000

                                                                                                                                                                    Chrome Cache Entry: 809

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):16738
                                                                                                                                                                    Entropy (8bit):7.957065215587382
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:34JFQgxFANy9RuOR4yLMONEb8SQzK7MTqeHagm6jNQLY:mxFRDIONEbuTZa76jNQM
                                                                                                                                                                    MD5:825A6363BAD058DBD4F46BCBB42425F6
                                                                                                                                                                    SHA1:B69352CFC5A58C9B5C05B63886D78F50569BAC22
                                                                                                                                                                    SHA-256:5C544B0ED6E645B9D089064FE66DA245369DE35BE261A9D34CCE6F82C7BD236E
                                                                                                                                                                    SHA-512:10E9E86866C2BB2E1F65A39C0CE9D64B1F6AE66FAEEC954A33218DBFC5620F738CC01A5A35C25F30EA37756ED72550D5E9A85CD2CD0956232A69778D4908B57A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426155654_1516086229170856_1992626987684584392_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=Xct8TC78RaUAX9iGfI_&_nc_ht=scontent-atl3-2.xx&oh=00_AfAPbr_6BCILIIhYLp_l2pcyEeZPZFCUCJP7eiyXkJRKEw&oe=65CF2E15
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100008b060000960f00002011000091120000ed1a0000ac270000c1280000c72a00009e2c000062410000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................?.=.gF#~...F.#S..f[.q.l......h.............t..V.u_..3.k..+...z...^6..V\.U..;.LYo..>..j.P.B.....Qc2..s....9M:..{..*.6E....r.}.P.2......B..T......;......TY/3\....'..(!h.:.~'.S)O.!..(....hyB..Va...:......+.B...x...4.{..../..5r~...'.x".=.......4.9.){Y.....l.R....K.. .B>..,4|.=fB......"...\....[@.L.%[^...7..K.. k....~.&.k.. /S&c...;.A..&....k.k....O*h..i..E#...h...0.U........,&"...a.]}..j.....q...=.9Fx.......4LnTlZ.f?Oyen$v....<..]B...........q....>.@.r..4B7...Z......{...*df.U.q..9r2.>.PMF..O.^[r..:.T..7m....^K.cO.}...y...AB.........r..../~..E^......./h4.O....^..Bm..\..'.....>...a.v.

                                                                                                                                                                    Chrome Cache Entry: 810

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):219842
                                                                                                                                                                    Entropy (8bit):5.458172734041145
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:3cQpl8zof/VUWU/FB6F8Dra3mgfWBncuKF/PJBJjVI:3cQpWzo/VAtUKgfWm/xBJZI
                                                                                                                                                                    MD5:A695D54827313162BEAEFFC952AB5D20
                                                                                                                                                                    SHA1:A19DB94EEA7B769F8D3D51EF68B1E4770FAB6C22
                                                                                                                                                                    SHA-256:61DA5403CA517C0484C3CBBA6DCD54AB6578126242C4E63BB55B5BF1F956876D
                                                                                                                                                                    SHA-512:AD13FA6ACF3A83E3C296E51A0212938048D43E65C3D460FAF4AE3726837268720521C0E96BFE8AE2609B8458F8D47ABFA34E58ACB396800F2A9DB1038D10BC88
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlHZcZ-3ai7P3Y5cI90bRd6SKaMSiw/m=_b,_tp"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0xd26c03f, 0x800b1c, 0x3e69cb33, 0x21c9c67b, 0x1, 0x0, 0x200d6000, 0x1d, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Sa,haa,$a,bb,cb,db,eb,iaa,fb,lb,jaa,kaa,pb,naa,paa,Fb,qaa,taa,vaa,Qb,zaa,Ub,Aaa,Baa,$b,Faa,Kaa,Laa,oc,Maa,Qaa,Raa,Taa,Uaa,Vaa,Waa,Wc,Zaa,Yaa,aba,dd,cd,bba,fd,dba,id,nd,eba,fba,yd,xd,gd,Ud,lba,Vd,oba,qba,nba,pba,Wd,Nd,rba,Xd,$d,sba,uba,vba,Od,ve,xe,Fe,Iba,Se,Ue,Ve,Ye,Lba,Nba,Pba,Qba,Rba,Sba,Vba,Xba,Zba,$ba,cca,mca,ica,oca,qca,rca,sca,tca,wca,yca,Bca,Cca,Dca,Eca,Fca,$f,Ica,Kca,Nca,Oca,aaa,Pca,tg,Qca,vg,Rca,Sca,xg,Uca,zg,ada,eda,dda,G

                                                                                                                                                                    Chrome Cache Entry: 811

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):2040
                                                                                                                                                                    Entropy (8bit):7.737024891674274
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:76Jof9iSBYD67iYpAeXjUK3w9AnPyopRRp1hh48d:7z9FiuoeXjUKgen1Xh
                                                                                                                                                                    MD5:0DB1FF27E543E59A6E58047649E5502B
                                                                                                                                                                    SHA1:65D480C1D3C5798639619ED3CAFACB1816E21119
                                                                                                                                                                    SHA-256:5DB49D5F1F9F063C5F995A25A8186A2CFE055B8925A36AC60CBB6867B200A5C2
                                                                                                                                                                    SHA-512:973DCCE99625804F3C9FDD85B9F08DC00562206E3F461117FA28550EB5019C4DECA2413327EFADFC9FD7A995CE7174D6ADCC56E0CAEBA0654B6D399FD2874D71
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://yt3.ggpht.com/tTNp70L20LWWf6PBWDJvgtfy4CEDcv7cc8jm8AdRfDVlmEl_DpXJh5nFYaqkXCRGslvc7zMn=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                    Preview:......JFIF......................................................................................................................................................D.D............................................@..........................!....."1u..678ATs....$Qa...&'(3Ut....................................>........................!..1r...AQRqs......"2345....Sa...C..............?.."....D. ....@".f(.0..A(..eP...^u..Z.i54.Q....5$.W..Dw!.......F.....r..& .3...k\..{8./...[.D.~.Q.1.....G.;.N..n\>..*..:...}.n..x..~..Sz...X.Q.....G.F.a.x<G...Uw..~.>..)........*.I8.M.e.!...2....o.J.#....x.t...F....kO..I...ZK..+.?8.s}.66.6.k.....G...c...x..n..U.p...{...*.6S....c:.\))m.5).p..'^.lv;.[.mF|..&Z\.....&.hQ..e.%.....`m...3Fj...Z.".x...o.Y|y....%2H..DR..E.k.....;hv..u..9..}c...7C...l.q.k@h.N....\...a.Od>.......y...=c.7.~.....|..>...O|..5(.^;....Mk...'.l..=..W....C....H.S..S.q.....}..%(aMX.Z..1G..}z..R........ts....ST+Q&.:.....1......:.{...x...j...E#.....2..T.d.....W.(....R

                                                                                                                                                                    Chrome Cache Entry: 812

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):563
                                                                                                                                                                    Entropy (8bit):4.367744360532535
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:t4noU/vmRTKd2aCJAzyXDMhkVFCzzZvSbeW03LxgI:t4oU/vo49yXghf5UTI
                                                                                                                                                                    MD5:3102D9E6EB6482A42839EFF1E5F4CB83
                                                                                                                                                                    SHA1:151E7A7B018C590EFF801936C8B3165E21D1F388
                                                                                                                                                                    SHA-256:A79054C0A39DB68BD70F2277EE512312190F32D0CCFB12B2B15A8DC833DA4772
                                                                                                                                                                    SHA-512:4131362A77102F48C615E40ECC95599300A239BF339831DA47E85A328929EAAB6AC63B67D64CE6FCBEB120D85865F5415C2188877822861BADCE5B908D206A0B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/person_circle/v8/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 2C6.48 2 2 6.48 2 12s4.48 10 10 10 10-4.48 10-10S17.52 2 12 2zm0 1c4.96 0 9 4.04 9 9 0 1.42-.34 2.76-.93 3.96-1.53-1.72-3.98-2.89-7.38-3.03A3.996 3.996 0 0016 9c0-2.21-1.79-4-4-4S8 6.79 8 9c0 1.97 1.43 3.6 3.31 3.93-3.4.14-5.85 1.31-7.38 3.03C3.34 14.76 3 13.42 3 12c0-4.96 4.04-9 9-9zM9 9c0-1.65 1.35-3 3-3s3 1.35 3 3-1.35 3-3 3-3-1.35-3-3zm3 12c-3.16 0-5.94-1.64-7.55-4.12C6.01 14.93 8.61 13.9 12 13.9c3.39 0 5.99 1.03 7.55 2.98C17.94 19.36 15.16 21 12 21z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 813

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):147
                                                                                                                                                                    Entropy (8bit):4.91608759200102
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHxKFUV12pppTJQrK/:tI9mc4slhohC/vmI4xKPJTeri
                                                                                                                                                                    MD5:BB349544319961A969D3B459602BC671
                                                                                                                                                                    SHA1:961C29B064625EB266A084F294F970E0A2A953DB
                                                                                                                                                                    SHA-256:489A97893CC1E6CD9267CB6B39BCC7DDC0D119A19408EF3B80E4F3798C78B1FD
                                                                                                                                                                    SHA-512:56168B9E178135D180DE402FFD8BD2D0412CB86C40831CBE709A4034F0FCB628A12096C3981D487FF48E134558701F8F1A458BFA0E48402C8A4FB32C0A9393A2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_up/v6/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M18.4 14.6 12 8.3l-6.4 6.3.8.8L12 9.7l5.6 5.7z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 814

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):154
                                                                                                                                                                    Entropy (8bit):4.827221770489101
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHTdEBhHIHWlYqY:tI9mc4slhohC/vmI45EBho+u
                                                                                                                                                                    MD5:FFFE8FD3C6ACCC2FCFDD7B66EA25B99A
                                                                                                                                                                    SHA1:13C31200084CB1EED7A746428D2B79AD34FF6790
                                                                                                                                                                    SHA-256:55A060294343CAFA3539424536540547F25EFD13A1D2373D7A5E966CE74C5699
                                                                                                                                                                    SHA-512:A6D8EB0393B4FB56D4B6025865F542B29AFEFAF7BB2B26E55C5B54974EB3B913E9A17AD54A8FE33525345AF3AD16EC60C06356582F72B3864731EC22C1838662
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_right/v4/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m9.4 18.4-.7-.7 5.6-5.6-5.7-5.7.7-.7 6.4 6.4-6.3 6.3z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 815

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):113808
                                                                                                                                                                    Entropy (8bit):5.548241924686477
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:041G70j5eM8jFVfuWpWQ+5b1aILZ+e3MgQUdi7gB9:041G70j8M8jFVPWQ+5b1aILZ+e3Mgxdh
                                                                                                                                                                    MD5:4159F5C0C45A3BB631C59E50ABB79651
                                                                                                                                                                    SHA1:63D3080A93A15A247739AC2093800C3A6A2ECCF2
                                                                                                                                                                    SHA-256:DBEEFCED81628A4D3E408D1CF451F579E511905E6E2DE3740757439FAAD0D390
                                                                                                                                                                    SHA-512:AB457A2C1C49D3D6D61D14E6EB19B8FF9C9EB00E502A72027E78C20E7F6C626786D619C09A6492A2EB2C2BB5A940F34690C29C0EE548CBEE5D93CA04E55E8944
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var Msb=_.y("ltDFwf");var fV=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.Qs(this).Zb(function(){this.Fa.length&&(this.Fa.forEach(this.E8,this),this.Fa=[]);this.La&&(this.La=!1,_.pr(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.pr(this.mb,"transform","scaleX("+this.ja+")"));_.Nr(b,"B6Vhqe",this.Ca);_.Nr(b,"D6TUi",this.ta);_.Nr(b,"juhVM",this.Ma);_.Nr(b,"qdulke",this.aa)}).build();this.ea();_.ph&&_.Qs(this).Zb(function(){b.ob("ieri7c")}).Ae().build()();_.Jz(this.oa().el(),this.Sa.bind(this))};_.A(fV,_.J);fV.Ba=_.J.Ba;.fV.prototype.Sa=function(a,b){Nsb(

                                                                                                                                                                    Chrome Cache Entry: 816

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):359
                                                                                                                                                                    Entropy (8bit):4.955472444225813
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4slzXdhC/yZqRIuZUoMLWlvSLrk91MLP25RjkxSRcATBrREjlC:t4BdU/mD8tKv9iDjkwRFTlGjI
                                                                                                                                                                    MD5:7EC75F80BDA2F53D6568AA6412D83431
                                                                                                                                                                    SHA1:9A94D2C509FE96BBD5A02971F066A1C1EEC6B3B6
                                                                                                                                                                    SHA-256:D8869F288C1E21A843123729543F5677E9B28349789C2282609CEC8ABC4DE9C1
                                                                                                                                                                    SHA-512:B2F2FE075F4AA2E0D73B4BF7B7F8BE3F43C6E6A7BF93165BE3178B7A20F5B0AE3B6CDC467B502EFEFE0337D5A98FA7039C224A3CDA6F455D70622B769314935B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.gstatic.com/youtube/img/icons/web/youtube_fill/youtube_shorts_brand_24/v1/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24">. <g>. <path d="M17.77,10.32l-1.2-.5L18,9.06a3.74,3.74,0,0,0-3.5-6.62L6,6.94a3.74,3.74,0,0,0,.23,6.74l1.2.49L6,14.93a3.75,3.75,0,0,0,3.5,6.63l8.5-4.5a3.74,3.74,0,0,0-.23-6.74Z" fill="red"/>. <polygon points="10 14.65 15 12 10 9.35 10 14.65" fill="#fff"/>. </g>.</svg>.

                                                                                                                                                                    Chrome Cache Entry: 817

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (45939)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):137130
                                                                                                                                                                    Entropy (8bit):5.132463425272866
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:YQ5uEi/bA+TnJDpamoObnmodwbwnwmwowd6/yW8RNK+blic1rU6fJGnjkuC6hfM0:rblic1rU6fJGjQ6hkefClYT+T5Y
                                                                                                                                                                    MD5:3A35D3553360601CF0783F72C11E5733
                                                                                                                                                                    SHA1:B7F88BE52B791BE3983420B281E690188DD85DE0
                                                                                                                                                                    SHA-256:235EA49A2D21CD63BBA6CF47A011FC00FA9F26FFBE8B9C554C8083D51F6CA2AF
                                                                                                                                                                    SHA-512:408A421EB0BAC831C8D9C2B7F02732E3131F4384C32AA50C8AE5DF02D0F618F60C7B8819A21FD2C45435F7F54667EA3C6B757189D9888A0F4FC2C94580E741AF
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3iQbs4/yt/l/en_US/nivIw9B3uAF.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometImageFromIXValueRelayWrapper_sprite.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometImageFromIXValueRelayWrapper_sprite",selections:[{alias:null,args:null,kind:"ScalarField",name:"sprited",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_map_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sprite_css_class",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"preloading_spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"w",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"h",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"p",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"sz",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"spi",storageKey:null},{alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},{alias:null,args:null,kind:"ScalarField",na

                                                                                                                                                                    Chrome Cache Entry: 818

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (9325)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):121768
                                                                                                                                                                    Entropy (8bit):5.487304317598877
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:sU89gbRe2ZifRgjgBdtCtF3LrR+2USMW3scHi9M8C:sU8yetRgjotCfE2Uxtm7
                                                                                                                                                                    MD5:82A52CFC656A5FC98EBF03AE7BACFAB5
                                                                                                                                                                    SHA1:0CE63AECEA000DF249F9D46AD84CEFFFF4E86F5B
                                                                                                                                                                    SHA-256:DB82BF4C92469F14CACB718110A1B8C977440193E9BF11A3A324088E80735041
                                                                                                                                                                    SHA-512:7B691B606A894A60A3F467DE2F1AB7EDCD2A86AD9F7AD5160A72124C492B60AB0753FC6554B8FBA3F4BAD8CC7423D4CB908739C44C72382AAD5956F8D80109B0
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yL/r/h2tSaw0REiE.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("GenderConst",[],(function(a,b,c,d,e,f){e.exports={NOT_A_PERSON:0,FEMALE_SINGULAR:1,MALE_SINGULAR:2,FEMALE_SINGULAR_GUESS:3,MALE_SINGULAR_GUESS:4,MIXED_UNKNOWN:5,NEUTER_SINGULAR:6,UNKNOWN_SINGULAR:7,FEMALE_PLURAL:8,MALE_PLURAL:9,NEUTER_PLURAL:10,UNKNOWN_PLURAL:11}}),null);.__d("IntlVariations",[],(function(a,b,c,d,e,f){e.exports={BITMASK_NUMBER:28,BITMASK_GENDER:3,NUMBER_ZERO:16,NUMBER_ONE:4,NUMBER_TWO:8,NUMBER_FEW:20,NUMBER_MANY:12,NUMBER_OTHER:24,GENDER_MALE:1,GENDER_FEMALE:2,GENDER_UNKNOWN:3}}),null);.__d("BanzaiWWW",["cr:1642797"],(function(a,b,c,d,e,f,g){g["default"]=b("cr:1642797")}),98);.__d("ReactImplementation",["unrecoverableViolation"],(function(a,b,c,d,e,f,g){var h=null,i=!1;function a(){i=!0;return h}function b(a){if(i)throw c("unrecoverableViolation")("React implementation cannot be injected after it was requested.","react_flight");if(h!=null)throw c("unrecoverableViolation")("React implementation has already been injected.","react_flight");h=a}g.ge

                                                                                                                                                                    Chrome Cache Entry: 819

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1856
                                                                                                                                                                    Entropy (8bit):7.186376301692151
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:g6YzM0iW3CSrIZytks/tk5yN8rmCWucUiTJuW9:4MCnMq1kA1rucvTJuy
                                                                                                                                                                    MD5:E65C7CE4CBF8DDC8E313AC98C7B1BD05
                                                                                                                                                                    SHA1:CB94927F07AA928DB2016B56637486B95D28BDC7
                                                                                                                                                                    SHA-256:E8DDE10E45F36C8BCF9AA80D8AD605629E79EA1A6707C54DC90F5A27640C71C1
                                                                                                                                                                    SHA-512:01D0FDFE0104D8C5706C6B217D7DA0294B4079BC010966BE70F37817393C04081D38FE7B232443DB069E8DBB56C716FA6F67EC5E77A80D00D40DEFF478B871A5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/426016429_963813995105421_9007631801452957213_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=rxrvq-Oi75EAX9v9wa6&_nc_ht=scontent-atl3-2.xx&oh=00_AfBIeksMRqRwH48gkhLz869jCji0Dtmqh2WLl9pTVG5XpA&oe=65CEC0E5
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000e401000088020000d202000020030000f8030000e20400001d05000074050000c705000040070000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."............................................................................).4.m.......$..v.|.4..&P..&Z..4."U3...O/.....=\.-+*...@..T.2.....%.........................!..#123..4.............0in...q.5..5...i...6....-WP..xS@f..X.....R\.e...&..\.VI..|...4g.....@.U...g....t.aP9......<.9.2.7j..~.......... .......................!A.#13a........?.B.S.Q..U@......o..n...OR3...O...........................1..!3B........?.7.j...dE>.j..e.?c!.G.....*.......................!1."2QaARq.#r............?...).:..8&....t...0..,LS]M..`......!.....n4.......c.....W.a......\5J..e..M...DV...v...@.s...I..0T...Q9......_(..A..\w....R.O.w.X6.....~q..Lt.|....'.sT.k.T.MD./..p..?...#.................

                                                                                                                                                                    Chrome Cache Entry: 820

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1610
                                                                                                                                                                    Entropy (8bit):7.010669757706514
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:gqKUWAOxc1spJXy1+Z8yS0CjQi3jii+46SlptaGp/hEDdy4mZ1m5Drv4:gxUWFxiWJXssSnjDGdcH874mZ4
                                                                                                                                                                    MD5:DDD72F3DFFCA7152B431CA228CF2433E
                                                                                                                                                                    SHA1:675232E3D7ECE8BB306F6D382EB064AAEB1EBD21
                                                                                                                                                                    SHA-256:9A266496B662FF851414F471503138DDFA365E89159A39F6C16C49C735E93F5C
                                                                                                                                                                    SHA-512:8E3CD65C2996475F45258782284FA94AF5734C5B52A48DC675EE3031097AB7FD4CE2BF37467F275785381A9AB1C45C98F41DF0E1511D3B7205E2C43BD2C72AF4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/301772151_496536915655500_843192677994421892_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=ox7LnJUoPuUAX_jR64K&_nc_ht=scontent-atl3-2.xx&oh=00_AfAGBjnKuP8_uuJhEmiWoxUXUx-lG1-ynNrwMnONNZkWEw&oe=65CE9058
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000e50100006b020000c302000019030000bc0300005c04000096040000e7040000390500004a060000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................A.'.vc_.....0..3.5.:.......:...Y.Yc$wL.......4...@..P.d........#..........................12B..!".............m...F.YngP.d.^....n..;..i L*..<.a..j.....U...<..%x.......r.v,..7Tz.J...G....^.O.?&.... ..........................!1.A........?.cv0..D.....n.X......0.{.....p~.1.........#.......................!....123..........?.&..a5.g..GQ......i....9d.W..}.p..o...'.......................!.1.. "AQ2a...........?...Y....R...E..nv|&5...0.7^..\;..k...._h..Q^....}...B..;b......(.jq+.D6..i..P8...1...i...p..M.nNe5....r?ZAh>z....:....!....................!1Aa.Qq............?!!..?p.~.O.p..r=Xb..(b....OZ..'x.f

                                                                                                                                                                    Chrome Cache Entry: 821

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (7696)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):8021
                                                                                                                                                                    Entropy (8bit):4.913098241979886
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:uRRGUcHwbEnZH0LqEcbuCUY3bkQsS6SxSrxbFvH7MJ/Jw:+GUcHOqEcbuCp3bkQspksxbOJ/Jw
                                                                                                                                                                    MD5:1CABDD97BA07D1A63323DD6E88CE2B99
                                                                                                                                                                    SHA1:EA28F191BAB9508D029044BAD372A24ED3B1D754
                                                                                                                                                                    SHA-256:750CB830233F0301A5112CB34D93F7423D5A1AE3EFCE787133F7AB58EE294D35
                                                                                                                                                                    SHA-512:896ED4D88A3700A2F7BDC9C0DC2396396EEC1DFBD9278E1F19043FC79ED98D11A48DBF335ED64F02651ACCAD4D73015010116847D7BC8DFBDE545FDE2634F9FB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/sw.js
                                                                                                                                                                    Preview:/** 10981929030278738210 */self.document = self; self.window = self;var ytcfg={d:function(){return window.yt&&yt.config_||ytcfg.data_||(ytcfg.data_={})},get:function(k,o){return k in ytcfg.d()?ytcfg.d()[k]:o},set:function(){var a=arguments;if(a.length>1)ytcfg.d()[a[0]]=a[1];else{var k;for(k in a[0])ytcfg.d()[k]=a[0][k]}}};.ytcfg.set({"EXPERIMENT_FLAGS":{"H5_enable_full_pacf_logging":true,"H5_use_async_logging":true,"ab_det_el_h":true,"ab_det_fet_wr":true,"ab_det_fet_wr_en":true,"ab_det_gen_re":true,"action_companion_center_align_description":true,"allow_skip_networkless":true,"att_web_record_metrics":true,"clear_user_partitioned_ls":true,"compress_gel":true,"csi_config_handling_infra":true,"deprecate_csi_has_info":true,"disable_child_node_auto_formatted_strings":true,"disable_pacf_logging_for_memory_limited_tv":true,"disable_simple_mixed_direction_formatted_strings":true,"disable_thumbnail_preloading":true,"embeds_transport_use_scheduler":true,"enable_ab_report_on_errorscreen":true,"en

                                                                                                                                                                    Chrome Cache Entry: 822

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:PNG image data, 49 x 74, 8-bit colormap, non-interlaced
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1633
                                                                                                                                                                    Entropy (8bit):7.352151724937379
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:Qy3Hwa/3ffWoAf6t+snxsGhlYUcGwMMQ1:xQaXfKG+IJcJM51
                                                                                                                                                                    MD5:72EE577BCC1A6A29D0422C3EB1248861
                                                                                                                                                                    SHA1:800818D8D4A3E67D49ED2A3A935B355F8452DDDD
                                                                                                                                                                    SHA-256:97FADFDD7D274DAABD9F7D79C817F4A9FACC08EBA67E38284698525E8A1FFFD0
                                                                                                                                                                    SHA-512:A373DB5E786A91D299394B45D707A067CEC708966B8757BF84F5BEF0F167E7EE4388C4356468526A6A8B4AD3521773FE78FDE18422B16F730D9116245544171B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/7NqDjYL3eb9.png
                                                                                                                                                                    Preview:.PNG........IHDR...1...J.....%.L,....PLTE.....................GpL...........................FFF......ooo...BBB.......................................NNN...uuu...............................................................999..................,,,.........AAA...............444......................................................777...WWW......:::.....................333........CCC........................zzzhhh....."""{{{...jjj.............%%%...555............................................bbbccc.........rrr......sssrrrsss.................................to.K....tRNSfJ....\.Td..hLfl.xP6.\x.....jf..|..N|`........N..R`..n..^.tVp..V.v...z...t.|.."^v.hfBlZX.j...tb..p~b....:4r..x...h......n.......n.t.....`.`.....b....b.................TIDATx^..es#G.....dY`.33...!3C.0.c.....~.|.D+E.f....}.T......j...3..3...)C."...'..........GK._..........J.....%..vw:....D&+5.fl... ..@..Q.4.$.h.&Zb..N.....b-.h.".....R'.b.n...!.T#..N.G.a..UEg.DZ.3.....OtC{......+.7.......E.$...

                                                                                                                                                                    Chrome Cache Entry: 823

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):16
                                                                                                                                                                    Entropy (8bit):3.875
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:HmnY:OY
                                                                                                                                                                    MD5:C13E70783B272C1B1F38DF78789CB038
                                                                                                                                                                    SHA1:7F182E8DA5EE7FB00A151AC0D205D71E9C017D94
                                                                                                                                                                    SHA-256:8800EFDDF6F05E9F2F4263946E6C5AB296C955138B006CE3A74D3B0F143BE92A
                                                                                                                                                                    SHA-512:A7F5941549D283934D49EE8BF8FA069D387FBDF3BBB86F884F14FD4E10EB5F6E754F55E0F3F94DCE79EF84FA2787A5F9DB8A24C74BA13BAF379DB66BF35FB8F9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8yq_jFOmFmxIFDfGjW-M=?alt=proto
                                                                                                                                                                    Preview:CgkKBw3xo1vjGgA=

                                                                                                                                                                    Chrome Cache Entry: 824

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (20386)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):24924
                                                                                                                                                                    Entropy (8bit):5.537665980419845
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:bTrUnwzqiCXznnxmmUCf9zTvJFZ5KDHjC6:bHUjznxmmUwZ5F6
                                                                                                                                                                    MD5:8920F24068591F7AB2116A415D97292C
                                                                                                                                                                    SHA1:FD0AB5393D94B67A01D4551E018FC4A1012B9CD9
                                                                                                                                                                    SHA-256:D272D673FCA66358522678651152C118D2584224BE3C136D9CD12AB547D30BFD
                                                                                                                                                                    SHA-512:C5A555572A4D0152C862E6EE387A810B9784B9144E2A62E4DB8A26BBF33551AF53BDB78093829A2338660D290ED699E7DA48330FFEC3034F89B2A3CDAEC0718C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yp/r/J_x7gaNByZQ.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometPageLayoutWithComplementaryContent.react",["BaseRow.react","BaseRowItem.react","CometMediaViewerFullscreenContext","CometRouteRenderType","CometScrollView.react","MWChatVisibilityOverrideContext","gkx","react","stylex","useMWShouldCurrentRouteOverrideChatVisibility","useShouldShowMessagingEntrypointOnCurrentRoute"],(function(a,b,c,d,e,f,g){"use strict";var h,i,j=i||(i=d("react")),k=i.useContext,l=c("gkx")("708253"),m=c("gkx")("1217157");b={chatSliver:{backgroundColor:"x1jx94hy",boxShadow:"x13tw4yp",display:"x78zum5",height:"xtp0wl1",top:"xxzkxad",width:"x1dmp6jm",zIndex:"x1vjfegm","@media (max-width: 899px)_display":"x1daaz14",$$css:!0},container:{height:"x3igimt",maxHeight:"xedcshv",overflowX:"x6ikm8r",overflowY:"x10wlt62","@media (max-width: 900px)_flexDirection":"x10o2a94",$$css:!0},containerFullScreenInPushView:{minHeight:"xg6iff7",$$css:!0},containerInPushView:{minHeight:"x1us19tq",$$css:!0},containerNotInPushView:{minHeight:"xat3117",$$css:!0},content

                                                                                                                                                                    Chrome Cache Entry: 825

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):9302
                                                                                                                                                                    Entropy (8bit):7.894976897720106
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:F018o5cJ0YA9nBK9VueUiOFla1i2WOjKS74B7jkL3HpyUQN3TWgo:e1u+BaWiOFsivOjHk7jKQUQNjWb
                                                                                                                                                                    MD5:54448E081AD88CBE952323DAE69EFEF9
                                                                                                                                                                    SHA1:ADE095237C81F61996A861643931767DC08171C8
                                                                                                                                                                    SHA-256:D6074B095FA8763E3396E14A0C19BFEAB71C2BE1BF89A6578E5062261B0C0357
                                                                                                                                                                    SHA-512:2ADD276A7EFEF799A56CEA03C49D39F7C27B344A0C303EB999B1D90F2F4D17B0AB0ADFF007A7CA072308C421B31851B953B5A11B7FD50173A2103D6BBB4F8D4C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/412265224_3041565169309543_3679943657011222564_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=X0Avi2NmhQIAX8yRdxV&_nc_ht=scontent-atl3-2.xx&oh=00_AfDAiD-E10OemlEhh08FXmAR45zivWW637L7QH-a9ImLHg&oe=65CF10B0
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000b90500009b0a00007a0b0000130c0000260e0000f414000005160000341700003018000056240000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."............................................................................E$...91.....D...eb.4.S.QnSQ.#....(T.%y.......m ..o..q......X[E]M[:&..Jk..R.N.".a.H.H.9\...`....,Q<iU.*4."C..j`.R...a.0.y....TH.]z...X.`G.].F...T...$.$...:..H.12.q...f.Z....c=].p.5,..<..FUP.....j...\C:ds..Q-.,.*...t.m.o.f..[3\..>...WSW...3.Nn .k..\.b@.$'..*...n.OE.SI..^1..~..,.)...#,.....U...e=!&..4h.._3J4.k'q.....1.~w......bY-S........H...:...P.t.=.2(4F>......{.Z.)c.bZQ..}0W.#.$-V..GWIVW.^..Vy.'n.V..k...Y.V.T1Yug..eSE.t..(...w}...Zo..S...(a,..':.z..\......kQh.).._...<.8....hg...!`._.....F....\....-ng..y.m{.'..p^.P..fe..r8.J..K.3.T..R.l:..^...CD...c.F.Co....IG@0.j.MB.^..b..F......

                                                                                                                                                                    Chrome Cache Entry: 826

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1116)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):74033
                                                                                                                                                                    Entropy (8bit):5.496125678356682
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:4GIr9iykWXc8VV4ucbxiyXdpGupDMbSrOLR0QZWtPWDG4nFjI9rkiDyVO9HI4Ckn:h45nb3nxQIiENg5Bi+C02by5
                                                                                                                                                                    MD5:1D50E206021F1BBACF8EC3080B04264A
                                                                                                                                                                    SHA1:5024B3A6930C7F8D47DE1472B38BA590A657F882
                                                                                                                                                                    SHA-256:9EE512AE80E59BE486F738680AA45ED4E31E7458A0B48F40128637B772224261
                                                                                                                                                                    SHA-512:5E065ED27D57432099060906B79C5B4849236CEE091C7FEDD8D57FC5732E5746AC5E5366497C4F31AE7A79D52EDF82104463A8E042D411820B219940BF2A9684
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&family=YouTube+Sans:wght@300..900&display=swap
                                                                                                                                                                    Preview:/*. * See: https://fonts.google.com/license/googlerestricted. */./* cyrillic-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCRc4EsA.woff2) format('woff2');. unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;.}./* cyrillic */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fABc4EsA.woff2) format('woff2');. unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;.}./* greek-ext */.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. font-display: swap;. src: url(https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fCBc4EsA.woff2) format('woff2');. unicode-range: U+1F00-1FFF;.}./* greek */.@font-face {. font-family: 'Roboto';. font-style: normal;. f

                                                                                                                                                                    Chrome Cache Entry: 827

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):6529
                                                                                                                                                                    Entropy (8bit):4.679709782974826
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:xm6jey1gwRj0yKmn1Z2rUKO5YhhzFEyDeg5n:M6CIgwJ0xm1wS5Yvzt
                                                                                                                                                                    MD5:BFC8E752C754A9B52D6BD4A963A7B9C3
                                                                                                                                                                    SHA1:7DDEF10D9AD3F43C89164B7DEBBC9CE26512B036
                                                                                                                                                                    SHA-256:704A5E15AE1068E4DF52A8BCFF04270EFDAD595CF685E0ECCFF86AB335471A46
                                                                                                                                                                    SHA-512:FF6415C30F7839666CE0BDB20FEA71D19630EA75904A4AAD710DC6431604532FBA48CFDA4B326BEAA6502ED727A0A9208DD624A4AC37B7601526BD611D7364BA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/search/audio/failure.mp3:2f6fcabbd02c08:0
                                                                                                                                                                    Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz.......................~.......k...................a...c...[...Z...c...`...d..._...^...\...e..."....stco................udta....meta......."hdlr........mdirappl.............nilst.....nam....data........error....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000063 0000000000004B5D 0000000

                                                                                                                                                                    Chrome Cache Entry: 828

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:PNG image data, 25 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):804
                                                                                                                                                                    Entropy (8bit):5.9272601627884605
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:6v/7ykl/f/je0aVMrCwGPlc+Zen0JTSdoc9EdyBw3w6xuS8SNGqsaNg:onBaVHwGPlxen0NSucwXoSJN+8g
                                                                                                                                                                    MD5:C156C107AE735C5F3813220235E0D11E
                                                                                                                                                                    SHA1:F655A14E144551432AAE9BA0A7FE0E237A65AE51
                                                                                                                                                                    SHA-256:D75C74B337113A0C65EBFF05ED63A487A0E158BC7246B987A28943667DF46C5B
                                                                                                                                                                    SHA-512:A2729CA423327C0855BDC68374AE0EA6B211043EBD39A63B7248BF4E288B9641BF3F827EA01C4FB0444BCFBC68B6E06B51EEDE746668F14D4F7225B9B941CC81
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yO/r/q8Uic1K195T.png
                                                                                                                                                                    Preview:.PNG........IHDR.......@......,n....PLTEGpL....................................................................................................................................................................................................................................................^.g...QtRNS..d....(..........B...:.>...0..XVLJ|<.t....Rv....6D4n.......@x.8...h..\... .NJ.!V....IDATx^...@...4Q@.yf.:1l.9.../3.M...l..U.#........$?...........kI]|.$GI&#.{.R..../d7$..x!.c..X..\B>...x./..X..[....SQ!@c\%..RNr"rrv.!.b.%.......j...n,...u..*).y.]."..r.b..P...B.FU....`.........s...,..y..(.3...!$.. ....F.(.a...g.?R.F.B:....$C...t...........\..N....c..2..`..VH.1..mF>.....t.L.MxDY....Y..U.6.$...O.(.....U.)/.e.mk..$.^.N....-........:.U.d.7...yp_i...Y.z....t..=...f#Q....IEND.B`.

                                                                                                                                                                    Chrome Cache Entry: 829

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (6544)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):30894
                                                                                                                                                                    Entropy (8bit):5.582255413109731
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:d+8HMmkEeGSQnBx355zXv2Vpfd2A2Yjdo5hdvWewVebB:hHVnPBh55zf2l2YD4
                                                                                                                                                                    MD5:5DB2E9B690BAE4CB3D2A9D6642CA8D21
                                                                                                                                                                    SHA1:770764B7A295383F43D8329AF176D6A86D7E4329
                                                                                                                                                                    SHA-256:AA56CF1BBD06C4F3447305FF0B69AD564E8D7CF21AEA94E58557906528B6F85C
                                                                                                                                                                    SHA-512:9305F285699CABB70AE4579F8CC270BDB8E53A3953B0D0892D6DE89074194890F9409C9B21C62927F0CBE6F74295997A1F744890F0F2B34A6F182453CD6F48E8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3i0Wo4/yI/l/en_US/gL55IJ8UaGt.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometContextualLayer.react",["BaseContextualLayer.react","react","useCometVisualChangeTracker","useMergeRefs"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||d("react");function a(a,b){var d=c("useCometVisualChangeTracker")();b=c("useMergeRefs")(b,d);return i.jsx(c("BaseContextualLayer.react"),babelHelpers["extends"]({},a,{ref:b}))}a.displayName=a.name+" [from "+f.id+"]";b=i.forwardRef(a);g["default"]=b}),98);.__d("CometTypeaheadProgressGlimmer.react",["CometProgressRingIndeterminate.react","react"],(function(a,b,c,d,e,f,g){"use strict";var h,i=h||d("react");function a(){return i.jsx("div",{className:"x6s0dn4 x78zum5 x1iyjqo2 xdd8jsf xl56j7k",children:i.jsx(c("CometProgressRingIndeterminate.react"),{color:"disabled",size:24})})}a.displayName=a.name+" [from "+f.id+"]";g["default"]=a}),98);.__d("cometTypeaheadKeyboardNavigationUtils",[],(function(a,b,c,d,e,f){"use strict";function a(a,b,c){if(a.length===0){c(null);return}var d=b!=null?a.findIndex(function(a){ret

                                                                                                                                                                    Chrome Cache Entry: 830

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):6167
                                                                                                                                                                    Entropy (8bit):4.4514990753759855
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:3ZCiNo0UQX1uXwGtjvjvDd3ti/F/0nP7/vEcKhirGGb7m/8sDM4UF9YX:Ai6nQX1uXZjvjLzGF8Pzv4E71EM4UP6
                                                                                                                                                                    MD5:81DFE7BB0CBBBC7468DDE13D3F649273
                                                                                                                                                                    SHA1:457BDF6F22B4C51255FBB5F198CA610B1037A932
                                                                                                                                                                    SHA-256:3B1F3E116BB9E9FBDD0D1643D703CAA562E235EBC0B814214A83C23B8CC271D6
                                                                                                                                                                    SHA-512:5BC6D25943EAE352363ED0123B9B178790AE2834A25178DA68603DC60E98FA531EA5148A2D93403A09829E0B387BC7E80A53CF8151CCB372A1386A1857F5F118
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/search/audio/open.mp3:2f6fcabbd44441:0
                                                                                                                                                                    Preview:... ftypM4A ....M4A mp42isom.......gmoov...lmvhd.............D..8.................................................@...................................trak...\tkhd....................8.................................................@...............mdia... mdhd.............D..8.U......"hdlr........soun.................?minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................Lstsz...................................i...................z...w...m...M....stco................udta....meta......."hdlr........mdirappl.............rilst...!.nam....data........speak_now....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 00000151 0000000000002E6F 00000000 00000000 00000000 0000

                                                                                                                                                                    Chrome Cache Entry: 831

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):327
                                                                                                                                                                    Entropy (8bit):4.811141801937251
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4slhLJ9hC/vmI4T7DmkHIMdZ72LYMFFMnxS1wTVcOLSvb:t47N9U/vmRT7Ck/dZ7BceS1McOLmb
                                                                                                                                                                    MD5:9F7171D7377F96797D3AA80C2A82E49F
                                                                                                                                                                    SHA1:E20980E2B3558839803623702CB63E594FD1EE48
                                                                                                                                                                    SHA-256:D7718E518AF1A501D91B19F97DD5CD28740782852C3FB0BE5B5F1A6855C26F4F
                                                                                                                                                                    SHA-512:9931C4904654C1BA487B71BB301FAC4C5F477845043B20A8705045FBAA3325A9907BCDF928B613B8B80B10E1D0AA81281473693066B056206C03C59FAD703932
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/search/v7/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="m20.87 20.17-5.59-5.59C16.35 13.35 17 11.75 17 10c0-3.87-3.13-7-7-7s-7 3.13-7 7 3.13 7 7 7c1.75 0 3.35-.65 4.58-1.71l5.59 5.59.7-.71zM10 16c-3.31 0-6-2.69-6-6s2.69-6 6-6 6 2.69 6 6-2.69 6-6 6z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 832

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):146
                                                                                                                                                                    Entropy (8bit):4.938964132950675
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHPKlhQtNNUunhjQAZi:tI9mc4slhohC/vmI4PKlGtNNUunJQ8i
                                                                                                                                                                    MD5:0BB6E79FC4160D867A915A7D17A564FC
                                                                                                                                                                    SHA1:E91CB173C9EEDDBFB2E61674DB09618A2479A053
                                                                                                                                                                    SHA-256:DD08185E1339EA9B3EEA5B27FC3401E2171CE008523F8038B6B08681B4E05906
                                                                                                                                                                    SHA-512:E1CB076164D3013612B36B41EAA43839A463C75104A85262CCC73B250ADEF1EC88D04D2A8F65D99D7EB89D4229022ECB4D3E370EE8BAC272426288A6F68C30F6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/bars_3/v2/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M21 6H3V5h18v1zm0 5H3v1h18v-1zm0 6H3v1h18v-1z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 833

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1998)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):163876
                                                                                                                                                                    Entropy (8bit):5.620330616178726
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:rvX5Lw5UCDJVZHL08oy6CiEETgDAGXoI7xuSrnCvn9nEBFqx0vI+FCTA0b4:rvX5LKUCDJVZHL08oyRiJsD7oIS9+FRj
                                                                                                                                                                    MD5:ABBE00637CCBFEF28C0D7A4560C880C0
                                                                                                                                                                    SHA1:A57DD9956928EFE35EB038D9C6FB40B87ACC4F66
                                                                                                                                                                    SHA-256:915514BEA40ABFDB462AD92B9CA3EDF5B7B371A8A79E7D1B523F7320B5DEA382
                                                                                                                                                                    SHA-512:5BBAC4CB331975167772F1D5084E12D17D4BA5DDB546A43490609402AB7D2F54E10F8BFD5746AA2528584D073B94C3150A73F66F6F0AC9945A19F6E3C2CEE5B5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/serviceworker-kevlar-appshell.vflset/serviceworker-kevlar-appshell.js
                                                                                                                                                                    Preview:'use strict';var aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ca=ba(this);function da(a,b){if(b)a:{var c=ca;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&aa(c,a,{configurable:!0,writable:!0,value:b})}}.function ea(a){function b(d){return a.next(d)}.function c(d){return a.throw(d)}.return new Promise(function(d,e){function f(g){g.done?d(g.value):Promise.resolve(g.value).then(b,c).then(f,e)}.f(a.next())})}.function r(a){return ea(a())}.function fa(a,b){a instanceof String&&(a+="");var c=0,d=!1,e={next:function(){if(!d&&c<a.length){

                                                                                                                                                                    Chrome Cache Entry: 834

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (65536), with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):2189467
                                                                                                                                                                    Entropy (8bit):4.926993298648243
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12288:NRpaQ+5+Fmt9CKkqFOdJ/JGfeiwtHWTOev3z69JGnez0TDJmgbVrdURo/4Q/5mJ4:zo/4Q/5mJkw10Xd
                                                                                                                                                                    MD5:093CF77528479982C5FEAFE57B3EC7BA
                                                                                                                                                                    SHA1:C86A8B615B174A7B4E290B4B25ED531B7D5699F1
                                                                                                                                                                    SHA-256:358D796721F00F773339D96C2E01C9EB38898B5B824B5C229ACF65123C7E2DBB
                                                                                                                                                                    SHA-512:091A79915F8DE827F46AE88FFDBD7142FAA8517EB1341A388E5424128A27F1A9B7617170405C0E8DC23B30E4849A158DBAD1B499411FA5F4F3E921B432A7295C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.XUNI0sq0Nu4.L.B1.O/am=ABAo/d=0/rs=AGKMywFMtyXYAkXLVFoLUIKsfXtVlJA1Wg
                                                                                                                                                                    Preview:.lottie-component{display:block}.yt-spec-icon-shape{display:flex;align-items:center;justify-content:center;width:100%;height:100%}.yt-core-attributed-string--inline-flex-mod{display:inline-flex;height:1.4em;vertical-align:middle}.yt-core-attributed-string--inline-block-mod{display:inline-block}.yt-core-attributed-string__image-element--image-alignment-bottom{vertical-align:bottom}.yt-core-attributed-string__image-element--image-alignment-baseline{vertical-align:baseline}.yt-core-attributed-string__image-element--image-alignment-vertical-center{align-self:center}.yt-core-attributed-string__link{text-decoration:none}.yt-core-attributed-string__link--display-type{display:inline}.yt-core-attributed-string__link--call-to-action-color{color:#065fd4}.yt-core-attributed-string__link--overlay-call-to-action-color{color:#3ea6ff}.yt-core-attributed-string--link-inherit-color .yt-core-attributed-string__link--call-to-action-color{color:inherit}.yt-core-attributed-string--highlight-text-decorator .

                                                                                                                                                                    Chrome Cache Entry: 835

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (682)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):4119
                                                                                                                                                                    Entropy (8bit):5.341681213096119
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:veQDGADGAkzVb7eZphVk/8uO6SWVHXG2XGfXdQFWqLJFldysb7IlwPeGEu9CyNnI:GHdBbgpKXO6757UtPAddyqE0BUIw
                                                                                                                                                                    MD5:31FB1DE7C9975E6514EDFE28D7DB1FE7
                                                                                                                                                                    SHA1:BECAB9E40A21A4B9E49CC0911C52D2FC58EA7754
                                                                                                                                                                    SHA-256:F1FAA8FCE74038DAFC13260C1884CDDF1A31A7855BA0EAB9C8BDFE32D8292235
                                                                                                                                                                    SHA-512:52E56C4C6DF65DC62F4DEE0DEF636D37B6112CE588851BD2B7CB88BCC9240A2F48088A4CB6655E549FA610E5CBB4B0096758F6EC4D78AD861E1B6B5B2831A4B5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
                                                                                                                                                                    Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.ng(_.Pma);._.k("sOXFj");.var Er=function(a){_.I.call(this,a.Ha)};_.A(Er,_.I);Er.Oa=_.I.Oa;Er.Ba=_.I.Ba;Er.prototype.aa=function(a){return a()};_.yr(_.Oma,Er);._.l();._.k("oGtAuc");._.nsa=new _.gl(_.Pma);._.l();._.k("q0xTif");.var mta=function(a){var b=function(d){_.Sm(d)&&(_.Sm(d).oc=null,_.Sr(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ds=function(a){_.cq.call(this,a.Ha);this.Ra=this.dom=null;if(this.Xh()){var b=_.il(this.Bf(),[_.Nl,_.Fl]);b=_.si([b[_.Nl],b[_.Fl]]).then(function(c){this.Ra=c[0];this.dom=c[1]},null,this);_.rr(this,b)}this.Ma=a.nh.v7};_.A(ds,_.cq);ds.Ba=function(){return{nh:{v7:function(){return _.Wf(this)}}}};ds.prototype.getContext=function(a){return this.Ma.getContext(a)};.ds.prototype.getData=function(a){return this.Ma.getData(a)};ds.protot

                                                                                                                                                                    Chrome Cache Entry: 836

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:PNG image data, 640 x 48, 8-bit/color RGBA, interlaced
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):9129
                                                                                                                                                                    Entropy (8bit):7.949132721882854
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:68pcTP8KvWsoTYaDeSTUN7Xj+OVoE3UxPZkGUpVRObHhTtP9kt7Zoy4LdsZ:HE8KhoTLa5XjTTklZ9UBO7vitnZ
                                                                                                                                                                    MD5:A848DD94722863511AD6B58E27B95F22
                                                                                                                                                                    SHA1:E34B91E4A8A5CACD9488700E0D4076ABE84651B0
                                                                                                                                                                    SHA-256:C117E153C0F61BA6E181349F4583A3CA73508D436FEB398300EE138EAE8C3286
                                                                                                                                                                    SHA-512:95E614C9F8483425FDD7B59F4EA464A0749CF2383012CA15A1822481E9DC10FB8B965BFFCF9E4336E935473F42CF3AACDC8500F2464FF02271D8442600B2126B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.gstatic.com/youtube/img/promos/growth/c117e153c0f61ba6e181349f4583a3ca73508d436feb398300ee138eae8c3286_640x48.png
                                                                                                                                                                    Preview:.PNG........IHDR.......0.............sRGB.......#cIDATx....$E.......%#.Ep.$...T.A.....`D....J.1..$....D@@@$...Cr....p.].......g.....g....V}..:.N.....6.$.Fc4....7.gL..*q..<..l......k...._Fs.aZC.4v..)O..x.*..M..J....#1.qy....m....q..U.Q.l,|.....d....-....1...%;Hc.q..2f...c%/.86.B.o.u.....NW^..k..^.1..(.s.N.3Ag*_`. .}L.8.2Mk......k)nv..rP...{u.`?...4......8>M+....4.4.v....J..r.O........ ... L..3....W...o..*Q.j.]9.G.0M....Z.....q..C.J*u.Z.;.~^..m...:......JwtLNqv..7.e.e.q.^M....Vn.}s*.u`V..\uX..&............Jz`uGc.f..Dq8b&..c.{k.o....0....+O.jrz.E.!?.G....'...&..K...4..1...Qe<.S...E^.8.M.y..bu......>..n...A.....t^O.o...Q\1..'.....d.(3.K+K..YD..6.e...c..-.I.Mf.`..-....%.....&h..x<. -..z!.q6m..g..@7d.d...........O...S\^..KC.......n.,..M..q....z.....p............MG.]G..V3.K.).u...3.....+...2i.NN..5q....-..y@.Bv/U..S.........u.i.5..$...kg.....ER.=~E.9:.e.....hn4.g..6.HSU..+.Zz..p..V...EfFK.0...g.EK(u..<.6.0...=.n'F.{Q...3.tA/..7..=P.#...`.

                                                                                                                                                                    Chrome Cache Entry: 837

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (10908)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):475060
                                                                                                                                                                    Entropy (8bit):5.580620311464981
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:05L0PfcrnFasY0aSIETGPtGCmvB29uwgxxY6syOdXDMl2I3UU7SyWTuuQvge16Ln:MAvd5MwgxAI3sT0vgvCUr+oQPuEwx
                                                                                                                                                                    MD5:0AF3B670E7F757E768B6B21B7A6763D8
                                                                                                                                                                    SHA1:ADDDC8300832D0BF5C50153B6C21FCD18CD73912
                                                                                                                                                                    SHA-256:F91488EA4E4644E8C66BB4621BDDA93BA302D881C7305635E038692938246F6C
                                                                                                                                                                    SHA-512:B35E4455A19C89C98BD2F86C32681D031E09135A1D0106C477AACA199373D58339467F648216D52E9E2560E1F2CFE9B9433B248B50657B967D905D6A1BB7FDCE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3iGBW4/yh/l/en_US/X3FHb7gfyAtExKoiOt0l0tr9hpDkbRsaAcR97Th9RLMffmYgSitUyiMG6J9qNt6L2kfdrLPKqmoqwxrFAEAvqD7evPbvFcpHZo5hkeVYt9L0bqtahTdecBO5eHHv03TfnAmn01U975kCvVolFK_RCKM9ITu5K9gX_Aa-pPdF6pB6SxQM7NFaxRfXDVy71PcfGUcaCdzXJNekCZ6S34zcHhszLr0G.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometFeedStoryMenuQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7083058335113269"}),null);.__d("CometFeedStoryMenuQuery$Parameters",["CometFeedStoryMenuQuery_facebookRelayOperation"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometFeedStoryMenuQuery_facebookRelayOperation"),metadata:{},name:"CometFeedStoryMenuQuery",operationKind:"query",text:null}};e.exports=a}),null);.__d("CometFeedStoryMenuSection_promotion.graphql",[],(function(a,b,c,d,e,f){"use strict";a={argumentDefinitions:[],kind:"Fragment",metadata:null,name:"CometFeedStoryMenuSection_promotion",selections:[{alias:null,args:null,concreteType:"QuickPromotion",kind:"LinkedField",name:"local_alerts_story_menu_promotion",plural:!1,selections:[{args:null,kind:"FragmentSpread",name:"useCometTooltipQP_quickPromotion"}],storageKey:null}],type:"CometFeedStoryDefaultContextLayoutStrategy",abstractKey:null};e.exports=a}),null);.__d("useCometTooltipQP

                                                                                                                                                                    Chrome Cache Entry: 838

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):34388
                                                                                                                                                                    Entropy (8bit):7.994479712430444
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:768:L/sD4CfVd6ICW0t2AEJFUYcDGx9hy4gLUr+kIgecgWY8Bw3:L/sD4SVk12AYExLXbcgmY
                                                                                                                                                                    MD5:E95E06E5FA36EA4376D909E9E6172223
                                                                                                                                                                    SHA1:A17F05CCCBB7DF9C667A751F78CC3E8093A5378A
                                                                                                                                                                    SHA-256:2AB70E06D33E4348889017DB0E7FEF9D9134D30747857983735D4A1B58F9FE57
                                                                                                                                                                    SHA-512:E125BB76D45D80CF30AE9DA55B550DF6B65145047CD0D11BD5242B50BEBC286643AF2EF577B45FEA5A7F4A7011E46E3AAFB1325C858A3C0947FB14002DFA36D9
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://i.ytimg.com/vi/7hYbrdC_-s8/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLAwOxyuvn-eZbEwynURITp3vMqyRQ
                                                                                                                                                                    Preview:RIFFL...WEBPVP8 @.......*....>Q$.E..!(..y....gAK.\.2't...#.`U........-.o..G..?...o.\l.6..H.~K.l..2...|.?`=r...o..7........LNBO\..<O...=.K.............~.......?.?G.........?0..zo.7..P.........'.q......O...`.f..........LO...............,~....L.E...K..........+.........|..,......._.......S...G...g..............o...?....S...o....m....=.._?.~..-...!..o..Sbo....g...t..j.P..xp1.R.k.[...#...w*.DO..F.T./...{.....%..{I~..MW;..).n.00g.-p.'..E.ZP@6..D6.....~......J...T=:.B <.]t...v^.,.(&...{U...f:.%..Sa..W..,\......|.8...Pc...b...d..v.`#9.C.......}..C..P>...A..K.y,.. P....<..(.T....>/{.@.z..[......w...".....q_K.G/.0`...w....y.L.5..y.r...*v..Do<F..O|...&4..)Vx....o..i...7..:.{...m4.j.u..3..Y.4..VV.2.....[utA..77W..^HO..A.!"|..........hARg.....#.4.m........)..]:t_.{.a.^%..g....J.&.....9..Q.t.6m<.Cr'o.].k..n.P".*.....k..u.v...:.{?.._x....~....1.G..#...~....e...Z.e.Wu<....%..$?6..lsV.4VXR.y...Zrj.. j..I.Ij.?..).y.G...Lw"1OE..n.....!^....X..........|..

                                                                                                                                                                    Chrome Cache Entry: 839

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):220
                                                                                                                                                                    Entropy (8bit):4.95427055782646
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4slhLJ9hC/vmI4VJD2zPdqUQx+dt:t47N9U/vmRf2bQxS
                                                                                                                                                                    MD5:64C5CFD76908E80E8D1C35BB65CF26CB
                                                                                                                                                                    SHA1:DCDA22BE3CFBA2AF2C7CD98465F601E8B3C5888A
                                                                                                                                                                    SHA-256:59BD8FAC9261910ADAE788A1BA4E550544F05A84312049D2C254FC37A7596CC1
                                                                                                                                                                    SHA-512:37C54AF2F2D644BBA688775BC77FB0AED604F9ED4675FF89117A0AA264C62A0291AFC145A7D20C4C4D14F13E6C460CF6D39B1F925E442BD7A3A190BA77B98DE7
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_fill/audio/v5/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 4v9.38c-.73-.84-1.8-1.38-3-1.38-2.21 0-4 1.79-4 4s1.79 4 4 4 4-1.79 4-4V8h6V4h-7z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 840

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1654
                                                                                                                                                                    Entropy (8bit):7.593819230205816
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:msPV2JskHKnMwibVZ/O8FLSKT6zHUIi5wIK9:LPEJFqnMfbVZW8dKFi5c
                                                                                                                                                                    MD5:3285C3870B9F7428A0D3280B9513AD1C
                                                                                                                                                                    SHA1:A543A2F2278FDC7D675C812A60C015646AAD1AB4
                                                                                                                                                                    SHA-256:ABC47D50620866D67D7B73B66F809C80F8F934CF7F8626A63D30916E9542C2DB
                                                                                                                                                                    SHA-512:CD367243B73D655CD029636937E4807446279FDC0086B4F950AF413B69F8B0FDA3ECF93B7C3D4B66CACD780D087B26C0B407D16CBF7CC8CA4EA8DBACF39E306A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://yt3.ggpht.com/dci6F84ANu2fyGC7mkvQ0etyOIN_Sg9D77p3Qy3SjENyk2N-QQaQrQ4JVwLzlAaDQEobPoN-=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                    Preview:......JFIF......................................................................................................................................................D.D..........................................................................!"1.Qa.Adt....#................................2.........................!1Aa.."Qqs....r.#2BRb..............?...uhY.%.L*.%..b.){p.JB.1V.M..pVAJ.!d......%..Z.).PK.K....PV.Q5pM.DD.....WOE..)..ZK$8..........P...{_.....e...(..J....;.h...qPR..q.L..$.c..!y...+*&.bq.6.I<.6.....|...s.4.w.[.....V....g.2c..k.Zn<.I..Q..Y..rip2H........../6.Z....uT?......$..6.s....E..a.:.;c-:f?.e-.:X..o.j.).].(q..cr.}.#;)>.'V`....0b'm.'c.{.uJ6U....*....D.G......=vF.. ...'/].....Ef.\...U....M]u.....9..#......G;.;.p.y..U}r.....R.R...=;..&d.[.F.J.^....k..@*..Bx*z.1!..RAeyW....ZS.<...tz.f.~.}Z.o..........My.gT..XMZP..._.....o........y...,..C.....6......x.}SO.\..j....p?.....+.h`....h^.....O...\[jO.._]iBZ....3.'....#*.B..u.M}...&W.:........|R&...g..yS.4..,.

                                                                                                                                                                    Chrome Cache Entry: 841

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):16043
                                                                                                                                                                    Entropy (8bit):7.950157770658987
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:3kZHvN37ki5zVAaF3xzXMyE79iJUe9hSXSbD:3qHF3Ii5zySz47atv
                                                                                                                                                                    MD5:D0263524899616D09CCC63C0795E0CF4
                                                                                                                                                                    SHA1:21CB6F7FB73BC94A61E00FF33EB3ED70785C3D08
                                                                                                                                                                    SHA-256:131C0019C2A01B9B7320DE7A555E4F4A681A70558657A07CCF1AEAC3CC345DA1
                                                                                                                                                                    SHA-512:0E2B9518E2484A314C1CFDBEB1A8570F9BF91C19C3710E5E2126F7501D1310240771AD518EEE5373C69EE1D040096C30FEFD66CB2043ACA284666EF7D06768E4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/425824299_925082448837800_8641990170560264580_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=HeSLf28TZ00AX8KEz5J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAdmmuxIsh3l9VCdVNx1B5Aoaun0jo0hKPRiqdoofjuSQ&oe=65CEB5CF
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000089060000020f00007610000021120000341b0000182700002e280000b3290000d22b0000ab3e0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................ru}.Q.k....v...k2...f......k.h...xb.h...i...y...k......]....i0..J..9....FI...'[.8n.@&.>.T..n.v.-..y..*.>.l..e.2QHc[..f...l}.6....dl.....=.6..`5.efcF..3z......%{.9...".i.i....7....Y.<}..r.......L...p..p...e-.ytvY..z.HO...\i.Kj........>-_5s....|..w.5.3.s.I....K.OI.^.Z+h7;.C....u4..P-.G..8........".....*..a........]|.~.[hY..D....p...8...kp....N....$..l...\.y.etwr.U..Q{....u&].........X..........oM2,.......f..qu.n....b..2...&.W.z4@....0.E...i..t....{w...\....G.SF....ZH..uk.=.<.>,..{0..P.....mA...KC%=;..^.....j*....y..S......[..%5.[.n.K...2..a....CLjU...i..5.3z.N.1..oo.....#_.

                                                                                                                                                                    Chrome Cache Entry: 842

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):113808
                                                                                                                                                                    Entropy (8bit):5.548241924686477
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:041G70j5eM8jFVfuWpWQ+5b1aILZ+e3MgQUdi7gB9:041G70j8M8jFVPWQ+5b1aILZ+e3Mgxdh
                                                                                                                                                                    MD5:4159F5C0C45A3BB631C59E50ABB79651
                                                                                                                                                                    SHA1:63D3080A93A15A247739AC2093800C3A6A2ECCF2
                                                                                                                                                                    SHA-256:DBEEFCED81628A4D3E408D1CF451F579E511905E6E2DE3740757439FAAD0D390
                                                                                                                                                                    SHA-512:AB457A2C1C49D3D6D61D14E6EB19B8FF9C9EB00E502A72027E78C20E7F6C626786D619C09A6492A2EB2C2BB5A940F34690C29C0EE548CBEE5D93CA04E55E8944
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,soHxf,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var Msb=_.y("ltDFwf");var fV=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.Qs(this).Zb(function(){this.Fa.length&&(this.Fa.forEach(this.E8,this),this.Fa=[]);this.La&&(this.La=!1,_.pr(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.pr(this.mb,"transform","scaleX("+this.ja+")"));_.Nr(b,"B6Vhqe",this.Ca);_.Nr(b,"D6TUi",this.ta);_.Nr(b,"juhVM",this.Ma);_.Nr(b,"qdulke",this.aa)}).build();this.ea();_.ph&&_.Qs(this).Zb(function(){b.ob("ieri7c")}).Ae().build()();_.Jz(this.oa().el(),this.Sa.bind(this))};_.A(fV,_.J);fV.Ba=_.J.Ba;.fV.prototype.Sa=function(a,b){Nsb(

                                                                                                                                                                    Chrome Cache Entry: 843

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):363
                                                                                                                                                                    Entropy (8bit):4.49126552549198
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4slhLJ9hC/vmI4CCUljullQ5dUiC7KITuMUxldUiiiC1ofuMUxldUiiiC17:t47N9U/vmRXKjullQ5d+puMUxldbfuMh
                                                                                                                                                                    MD5:82A60FADA6F7957329BEEE85E0453CAF
                                                                                                                                                                    SHA1:6882C6B5F04787D57F3B59C1D1559623BC40E146
                                                                                                                                                                    SHA-256:98901DDFF67E245769A3E1F47ABA0210653F817436CE288646FC0BB88E859CFA
                                                                                                                                                                    SHA-512:646BE4874078FB5B9072DF552DA8CF0A1E5533D1B65392E06008676D8B06CA3E5EAFAC14C89BB580E0A7EAAEE94B3EC0825174328C3B30FC92D66730FBAD373F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/overflow_vertical/v10/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" enable-background="new 0 0 24 24" height="24" viewBox="0 0 24 24" width="24"><path d="M12 16.5c.83 0 1.5.67 1.5 1.5s-.67 1.5-1.5 1.5-1.5-.67-1.5-1.5.67-1.5 1.5-1.5zM10.5 12c0 .83.67 1.5 1.5 1.5s1.5-.67 1.5-1.5-.67-1.5-1.5-1.5-1.5.67-1.5 1.5zm0-6c0 .83.67 1.5 1.5 1.5s1.5-.67 1.5-1.5-.67-1.5-1.5-1.5-1.5.67-1.5 1.5z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 844

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (826)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):8035
                                                                                                                                                                    Entropy (8bit):5.318512945699808
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:Td3BL/z3WKN4THrowJ7cKE03viAgdgF/dYiEyX3NSDg:jjnN4jrowJcKEw/gdgRdYiEk3Ag
                                                                                                                                                                    MD5:C8C34632BE75E5391C96E23353A594CC
                                                                                                                                                                    SHA1:D1D82CB6837896DD9CE510C1CF6AA25C486B6828
                                                                                                                                                                    SHA-256:E6E2886050EF8823F376B82E51DB52CA50FB6C51294577BCA31DAE39A1E884E2
                                                                                                                                                                    SHA-512:6FFA30B8A5E408F8DB640A007584172DBE85E8EC0715E03F2E0CE92E1C5D0CF291EFF8A7F0A3DE5552CE23EB739C795598A1ADFF95DEC3E88F8D79EB8F2D761E
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,NTMZac,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,XiNDcc,YHI3We,YTxL4,ZUKRxc,ZZ4WUe,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,q0xTif,qPfo0c,qmdT9,sOXFj,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=wg1P6b"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.FKa=_.y("wg1P6b",[_.sy,_.Am]);._.k("wg1P6b");.var t_a=function(a,b){b=b||_.Ma;for(var c=0,d=a.length,e;c<d;){var f=c+(d-c>>>1);var g=b(0,a[f]);0<g?c=f+1:(d=f,e=!g)}return e?c:-c-1},u_a=function(a,b){for(;b=b.previousSibling;)if(b==a)return-1;return 1},v_a=function(a,b){var c=a.parentNode;if(c==b)return-1;for(;b.parentNode!=c;)b=b.parentNode;return u_a(b,a)},w_a=function(a,b){if(a==b)return 0;if(a.compareDocumentPosition)return a.compareDocumentPosition(b)&2?1:-1;if(_.ph&&!(9<=Number(_.zh))){if(9==a.nodeType)return-1;if(9==b.nodeType)return 1}if("sourceIndex"in.a||a.parentNode&&"sourceIndex"in a.parentNode){var c=1==a.nodeType,d=1==b.nodeType;if(c&&d)return a.sourceIndex-b.sourceIndex;var e=a.parentNode,f=b.parentNode;return e==f?u_a(a,b):!c&&_.ji(e,b)?-1*v_a(a,b):!d&&_.ji(f,a)?v_a(b,a):(c?a.sourceIndex:e.sourceIndex)-(d?b.sourceIndex:f.sourceIndex)}d=_.Sh(a);c=d.createRange

                                                                                                                                                                    Chrome Cache Entry: 845

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:GIF image data, version 89a, 1 x 1
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):42
                                                                                                                                                                    Entropy (8bit):2.9881439641616536
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:CUXPQE/xlEy:1QEoy
                                                                                                                                                                    MD5:D89746888DA2D9510B64A9F031EAECD5
                                                                                                                                                                    SHA1:D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
                                                                                                                                                                    SHA-256:EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
                                                                                                                                                                    SHA-512:D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.google.com/pagead/lvz?evtid=ACd6Kty1U_f5jvyAiT8Ih5YhPyONZSmmtDafuJ4xqgqLzI6ZNCgwsxd_-6e-KLvYeEscvd0aWi11E6czPehza7j3rPcJVivzAQ&req_ts=1707766828&pg=MainAppBootstrap%3AHome&az=1&sigh=AB9vU40O-x8gYKZSz_GBWawyAlAfR3onpg
                                                                                                                                                                    Preview:GIF89a.............!.......,...........D.;

                                                                                                                                                                    Chrome Cache Entry: 846

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (533)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):5547
                                                                                                                                                                    Entropy (8bit):5.234104150395812
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:+E8YzVFXsVws8HYnkfI+C4yVdbaiGkNF2LSaAuEeRzgf5j6YJR79hamaWslv0Rw:+ajsVws8Hlzg2i/N9hzWgf5jhJR79haZ
                                                                                                                                                                    MD5:936A7C8159737DF8DCE532F9EA4D38B4
                                                                                                                                                                    SHA1:8834EA22EFF1BDFD35D2EF3F76D0E552E75E83C5
                                                                                                                                                                    SHA-256:3EA95AF77E18116ED0E8B52BB2C0794D1259150671E02994AC2A8845BD1AD5B9
                                                                                                                                                                    SHA-512:54471260A278D5E740782524392249427366C56B288C302C73D643A24C96D99A487507FBE1C47E050A52144713DFEB64CD37BC6359F443CE5F8FEB1A2856A70A
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/intersection-observer.min.vflset/intersection-observer.min.js
                                                                                                                                                                    Preview:/*.. Copyright 2016 Google Inc. All Rights Reserved... Licensed under the W3C SOFTWARE AND DOCUMENT NOTICE AND LICENSE... https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document..*/.(function(f,h){function t(a){this.time=a.time;this.target=a.target;this.rootBounds=a.rootBounds;this.boundingClientRect=a.boundingClientRect;this.intersectionRect=a.intersectionRect||q();this.isIntersecting=!!a.intersectionRect;a=this.boundingClientRect;a=a.width*a.height;var b=this.intersectionRect;b=b.width*b.height;this.intersectionRatio=a?b/a:this.isIntersecting?1:0}function d(a,b){b=b||{};if("function"!=typeof a)throw Error("callback must be a function");if(b.root&&1!=b.root.nodeType)throw Error("root must be an Element");.this.g=y(this.g.bind(this),this.B);this.D=a;this.h=[];this.i=[];this.s=this.L(b.rootMargin);this.thresholds=this.J(b.threshold);this.root=b.root||null;this.rootMargin=this.s.map(function(c){return c.value+c.unit}).join(" ")}function y(a,b){var c=null;return function

                                                                                                                                                                    Chrome Cache Entry: 847

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):15499
                                                                                                                                                                    Entropy (8bit):7.955559686251681
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:Y1Sz22S28LTx9tbUNkN41oajOnj/2GQnw88eXDLHGghyRuNwjY6qnC2F7Dgs3:+K2J9tbKQFgnHGuNwU6qCSgs3
                                                                                                                                                                    MD5:92E0FC6DD034D6BEBE6EF8C569BD6310
                                                                                                                                                                    SHA1:D12F6C6BF7F0C747057BD02A45E7770708FE4C44
                                                                                                                                                                    SHA-256:E7A7D8DAC030B17C9B767FE1F251299BBE1DD8CB7754A315757F58F638CEE233
                                                                                                                                                                    SHA-512:AAC06E7BAF4EF12FF03DC8C96202AA42CC1D864E0E87A6B493CA581F3B5BF8061B79C303AF637A76A8E560B43599F0879FB257B045A64CF3F01E79712C66CEAD
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/423510226_709883044461963_5185311792109741983_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=cIbOJ88sJAMAX9JVxu5&_nc_ht=scontent-atl3-2.xx&oh=00_AfCfW4SuEqbQegxvpZH1KS8z3EWSCHFTlhWNT_T5m0c18A&oe=65CF055C
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000007060000540d0000550e0000cb0f000063170000a9230000b9240000032600007e2700008b3c0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................~...z..&P.:d...L......1..t.uY..L.........Q.......0..\..o.T{l..54UC.x..u."....p{..3...N.G@.RH..5Zkd..P'x..dQ".[.z.~x.=iq.s~~l..-..K..L...2Fd..<./+.....JqLi..U....5l/(.n...`..9....y....7d.Q......V.M.......`....6.&..!..u..Y.X*.m+..........o>E.O.f..i@.4..;...(...u,..5.N.k.+}.+h...+nS{>.keKC..BY..>&^....Wu..od..0..s..-,.=..d=3.[&.._'<..........#.x....q..z.%...$..*..l.1.#..d-a.Q.u...u..rz}g&....s....w..#-..y....L..K.{..JI.iM.I#..'...V..8.;....M.......|R.g.?Go..........\.=..i3;e..\[Gj.y..{.R.s.(.u..U...-..\.......+..^.m..3.;I..6k..SL.84.g.M..pn=.Tz........$........./g

                                                                                                                                                                    Chrome Cache Entry: 848

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 68x68, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):3397
                                                                                                                                                                    Entropy (8bit):7.851129833004722
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:bjTIHTiC5DCaswQh8nKwjPD7gTLJEIdbxCW6C:bj4Ti+jswQuKS7gJx4Wf
                                                                                                                                                                    MD5:2C11C09B391E40497C82A7BAF03416AB
                                                                                                                                                                    SHA1:050C2776422C3D7473CE27855A377E840D19314D
                                                                                                                                                                    SHA-256:5D71F8CD8037F1CF00B1A798C8068455978A8E7810D1E842CC93C7A2C541B36E
                                                                                                                                                                    SHA-512:1C97477BC48DDD3E5E6E985D4E0E6FB008184A9B820FEA991417F09E0995C07021713EBFE12272C8884C2293A9E1C1DC4F05909604F0BB979FF87298D21B65AC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://yt3.ggpht.com/NPeGcCi0T4dUX3C7rX2TTkhzjAuyVjRzxgDSr42V3DivjoJ4nCJCrn1UNQE-LWef_aEkLnIJ=s68-c-k-c0x00ffffff-no-rj
                                                                                                                                                                    Preview:......JFIF......................................................................................................................................................D.D............................................6............................!.1."A#2Qa.Rq.....%3BS................................./......................!1..AQaq...".....b..2C............?......i$.:i+]q..T3d..*<.>H.<d.u..-.t..H.....0...y..:.(..Q...6b..%..Z.4.(.....G'..9eUu#.|.r..c2**=...}.=MWQ..KA..`.:_3h..Cb7.}...S....e.u...m.8^,.y.....`.|.tT........&<p...!.....&...=0......2....r..|..!B...A..#....k..V{.=.)..4d...{8@G...D....o....f..=kW.V....M.;..E.T4.....'..T.Z..s...c.5..r5Di........[.Q....@`....w'.s...R....E.e&.$....k..}uF..J...j.v.z.-..J.}'...B....u.b_..N......2...1.AB.C..<..2|.Ym...Kr..Z5>.Z.B.^h.L3-mDd....2..[>X....M.8+.Z....ONbc.......m....K;..a....]d.l...&A....X...+..7g.....o...Ezuu4.. .'.;......M.un.....h..+QC...x.&e$:D...H.vY#....H.7:D4.......!..2`v.......D.......[......h......C. J.HE.

                                                                                                                                                                    Chrome Cache Entry: 849

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):2068
                                                                                                                                                                    Entropy (8bit):6.752074837549245
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:7dl/ulERq4iWvvKb+ti2ePRH3vV4h3bpO:Rl/P0crcnp3Kh3dO
                                                                                                                                                                    MD5:6B93D847E1F1B5329A125D013E66CB70
                                                                                                                                                                    SHA1:F3F8DFE8A72AAB4ED85E6FAE3491BD073929A9B0
                                                                                                                                                                    SHA-256:1CE1B6603E7EDADA4AE38E1ACC6C6DE41629342A38166F035C47938D3F666535
                                                                                                                                                                    SHA-512:2C3CAF1261E8437EBFE3999E3E6139369C4E6DCF198947FA1C9E2828DA04E529928F419187E1BEE279F31493211AB1298D32C7B87CC10142BDC4F7BFA46A76C2
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/426167020_934652098279358_7390071020670031193_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=HoYEJyQc_GkAX-TW8Su&_nc_ht=scontent-atl3-2.xx&oh=00_AfDZQJIGnBiQh7Yh8PinWJ4V6aKKIKdK8v1HKuUvHmGKeg&oe=65CF644E
                                                                                                                                                                    Preview:......JFIF..............ICC_PROFILE.......lcms....mntrRGB XYZ ............acspMSFT....sawsctrl.......................-hand.......<.Q.E(z..................................desc.......^cprt........wtpt........rXYZ...,....gXYZ...@....bXYZ...T....rTRC...h...`gTRC...h...`bTRC...h...`desc........uP3.............text....CC0.XYZ .......Q........XYZ ..........=.....XYZ ......J....7....XYZ ......(8.......curv.......*...|.....u.....N.....b.......j.. C$.)j.~3.9.?.FWM6Tv\.d.l.uV~..,.6..........e.w........Photoshop 3.0.8BIM.......h..(.bFBMD0a000a47030000bd030000540400008a040000ce0400007605000029060000610600009a060000db06000014080000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."..............................................................................IJ.._.....X.....A]k..#....D"....F...?5d%>....X.u..YX..a..s ....$..........................1..!"#2A...........fy..Df..a....Eo..a.........~..%

                                                                                                                                                                    Chrome Cache Entry: 850

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (8178)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):75837
                                                                                                                                                                    Entropy (8bit):5.531365885848518
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:Vgd6Fz6U5v/FSisNk3a+awDbDi21/WJhIfx4oVBmb56iiC+:PF/1/WJhIfxwwir+
                                                                                                                                                                    MD5:FCD49F005A810FFEDDFEAF5FB9673684
                                                                                                                                                                    SHA1:A54243DF8D8B25A7EA59D2D6538D7F6602CEF78B
                                                                                                                                                                    SHA-256:CA62FBBB1DBB698136E9D996207B48E5909CD8B57998CDA476FA905637A6BE79
                                                                                                                                                                    SHA-512:C82A5677C05C43047F0EB458DCA82C292F183A0C6C10A8CC55DEE0DD2B05A3E849E0A8B2CB4D4260E5B0CCB8C9D2DDC60B43B98769F28B64E2BC59E7150760DC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3ig-p4/yJ/l/en_US/Z7TM47D79cyjZGllLOZSYZXcdRiuTgoXi8PV9MqBxcdE3PY_y5K0sLA_8RP_DKAj3_xsw_y3zVOBSd8w70Ttksmt5r1v89-9txafWxL1rr0Obq.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometTextWithEntitiesRelay_entity.graphql",[],(function(a,b,c,d,e,f){"use strict";a=function(){var a={alias:null,args:null,concreteType:"WorkForeignEntityInfo",kind:"LinkedField",name:"work_foreign_entity_info",plural:!1,selections:[{alias:null,args:null,kind:"ScalarField",name:"type",storageKey:null}],storageKey:null},b={kind:"Variable",name:"scale",variableName:"scale"},c={alias:null,args:null,kind:"ScalarField",name:"height",storageKey:null},d={alias:null,args:null,kind:"ScalarField",name:"uri",storageKey:null},e={alias:null,args:null,kind:"ScalarField",name:"width",storageKey:null},f={alias:null,args:null,kind:"ScalarField",name:"name",storageKey:null};return{argumentDefinitions:[{kind:"RootArgument",name:"scale"}],kind:"Fragment",metadata:{mask:!1},name:"CometTextWithEntitiesRelay_entity",selections:[{alias:null,args:null,kind:"ScalarField",name:"__typename",storageKey:null},{alias:null,args:[{kind:"Literal",name:"site",value:"comet"}],kind:"ScalarField",na

                                                                                                                                                                    Chrome Cache Entry: 851

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1299)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):45866
                                                                                                                                                                    Entropy (8bit):5.475609206794049
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:UqHLghKGWJdnHaOSbzAvqQqaqLY0P+uRjHUi+CF5JFDpcDAtlnko5pL+A9SfXyGB:NZVqfLEDqgRFVfZYWILkYAWIKHC
                                                                                                                                                                    MD5:9F3B65B2B5693F4A56C782FA627B0516
                                                                                                                                                                    SHA1:4BEC64AC09F7DC79322DDF49CCFD72782F68E94D
                                                                                                                                                                    SHA-256:D6C5F1914AAF2206D4731192B539200448C4B2C0CF2B6DE6532949CE0CE55277
                                                                                                                                                                    SHA-512:8EF85CD992A8657D00B3208C0D7E793D5DB95658E076DE3529B0B93CB6A1D7AF0E66050AF21F3C9E4DE66500DCC6833AADD60F5A18F28268F00AE90A0B463A83
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=soHxf"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{.var Iqa;_.Hqa=function(a){var b;_.Pf(a,function(c){return _.Nf(c)?(b=_.Nf(c),!0):!1},!0);return b||a};_.gg.prototype.Xh=_.ca(31,function(){return this.aa||void 0});_.bq=function(a,b,c){return b.tb?b.yo?b.iI(a,b.tb,b.Kg,c,void 0,!0):b.iI(a,b.tb,b.Kg,c,!0):b.yo?b.iI(a,b.Kg,c,void 0,!0):b.iI(a,b.Kg,c,!0)};_.cq=function(a){_.Sg.call(this);this.Fr=a.nh.key;this.hx=a.nh&&a.nh.Xa;this.vq=[]};_.A(_.cq,_.Sg);_.cq.prototype.Uc=function(){this.we();this.LL();_.Sg.prototype.Uc.call(this)};_.cq.prototype.x9=function(){return this.Fr};._.cq.prototype.toString=function(){return this.Fr+"["+_.Ja(this)+"]"};_.cq.prototype.nU=function(){};_.cq.Ba=function(a){return{nh:{key:function(){return _.Wf(a)},Xa:function(){return _.Wf(this.Xh())}}}};_.dq=function(a){a.Ba=a.Ba||function(){}};._.eq=function(a,b,c){c=Iqa(b,c,a).addCallback(function(d){return new b(d)});c.addCallback(function(d){if(d.vq.len

                                                                                                                                                                    Chrome Cache Entry: 852

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):89852
                                                                                                                                                                    Entropy (8bit):7.984241718374733
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:YiCywgJ0ro7MMyH9rQrhOoESsckfRuokSAOewpe8RCAfuWyW:NLirbMZWZcORuoqYotWyW
                                                                                                                                                                    MD5:78F3A739349CCDE8AA1147310C0E238D
                                                                                                                                                                    SHA1:8D41C3AA0B16D4FB121602664AD293FF720F86D0
                                                                                                                                                                    SHA-256:C33D96341EB1EF954AF364832557835819AC3D683BC1FF5116378C2CB00B5349
                                                                                                                                                                    SHA-512:AD67BEF7B00E5D916E2304EDCBD47975300DD44B9CD856311E86ED6711AC6FBAE67297574FA905F21C706EC16748402FEB951AFA710C27D61003B7DFFBC13350
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426391677_1431786894213586_9153978234903197934_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=KkSXlk94CEEAX8rwqk6&_nc_ht=scontent-atl3-2.xx&oh=00_AfD0_XaJTHujwlXPTOwAXP5x0rBUuxMmJIyvypano-X_Xw&oe=65CFE665
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000da200000a2590000815e0000e46300004c900000cbd70000fbdd000003e6000048ee0000fc5e0100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................./..|..e.gkT..*K.i..Ip6F,....x=U..79..w..b..........k.^N..$z...?E"...Z".0_..B=a)..,..%.z7.6`.IR$)GT.y...gQ..<..P.*B.Lt.F..-`z.h.mu..l.}..2|...]>..........uv:..#..b.UZ.*..v.....XerT...HX.4.Ad.$!.Z.dJ...O..BK...R.FYU-O+c.,.f..+..CP.B......P.K....k....,z...$d..,.5.k...*l....)..........C+6p.mC.....i'....."..Y.s..H.9.Y..X.N1b.Nj.......829....).,K...Do.S..,+...xu..s=..z..A.SMr.;8..s.^.w..u+..iu...`.Hm!.......JH..!.......X.9......-H....G..')`[.9j.3......ve$.`..#..w:.=...e[....1.8.u...Y(.u...,.yy.6c.....`?C...z...g%2.....Y.PtcJ=.s..1k(.d..3.I..0M8z.k.^..Q'q..%.!i..n*j.*......E.....

                                                                                                                                                                    Chrome Cache Entry: 853

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (4850)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):101785
                                                                                                                                                                    Entropy (8bit):5.455230952684927
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:nTZPXcX3Z5iHe5yZJuHs0HrVKDnPYTrkuT32ox:nTlXS3Z5Se0ZYs0HrVKD44uT32ox
                                                                                                                                                                    MD5:05DE60989A00D2788AED14A5380B943B
                                                                                                                                                                    SHA1:D49391B27384A459110407A42C0218E90B4EB277
                                                                                                                                                                    SHA-256:BA2CF08302978F4246E460C1C0CCE86EEC57C1F976C45A63D957599545559106
                                                                                                                                                                    SHA-512:4E9FFBAC608C06888DC297DC09B5CD73B35819F62710CD2579887F744E219F1EA2E85FF95A48520C5ACD39AD417E26726117007874925FF087DB1C397197C558
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3icUr4/y3/l/en_US/FBIgbJYSCa-.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("TahoeTypedLogger",["Banzai","GeneratedLoggerUtils"],(function(a,b,c,d,e,f){"use strict";a=function(){function a(){this.$1={}}var c=a.prototype;c.log=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,b("Banzai").BASIC,a)};c.logVital=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,b("Banzai").VITAL,a)};c.logImmediately=function(a){b("GeneratedLoggerUtils").log("logger:TahoeLoggerConfig",this.$1,{signal:!0},a)};c.clear=function(){this.$1={};return this};c.getData=function(){return babelHelpers["extends"]({},this.$1)};c.updateData=function(a){this.$1=babelHelpers["extends"]({},this.$1,a);return this};c.setChainDepth=function(a){this.$1.chain_depth=a;return this};c.setChainingContextIdentifier=function(a){this.$1.chaining_context_identifier=a;return this};c.setEvent=function(a){this.$1.event=a;return this};c.setIsAutoplaying=function(a){this.$1.is_autoplaying=a;return this};c.setMediaID=function(a){this.$1.media

                                                                                                                                                                    Chrome Cache Entry: 854

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (16083)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):655354
                                                                                                                                                                    Entropy (8bit):5.73737210338677
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:ZlY057YvxAWjm/CXHc7MoEq9u2jCJy/q4IsjFJS+3fFyWxvkTIJcII1:Z+057YvxApocg2jBjXS+ty8vG1
                                                                                                                                                                    MD5:DA82B1846B1D2D07685AC3E0F50AB5AB
                                                                                                                                                                    SHA1:5BE4E8061CD00BE19C344919A243BD1099D732CA
                                                                                                                                                                    SHA-256:4F0686CF232CCEC0F767D5DE6AEA24810F81741E355D460AFA2F9C565E67D239
                                                                                                                                                                    SHA-512:576A5BB1733796B5E012694906F2FAD223FB4A1789AA431E3A1C853D8F528DAC1BCB511F34D4809F089D2CBD1B54E2D24F6E2075EA812114A587FAC8ED9EF2F8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                    Preview:"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

                                                                                                                                                                    Chrome Cache Entry: 855

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1249)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):88390
                                                                                                                                                                    Entropy (8bit):5.540592100207294
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:041G70j5eM8pHt7yq6wbGWd+55B1aILZ+e3tigS/UduNP7gBMZC0GDqW:041G70j5eM8mQ+5b1aILZ+e3MgQUdi7K
                                                                                                                                                                    MD5:800BE3FDA387366B8DFAC408CAE74AAB
                                                                                                                                                                    SHA1:DD91AF6E8F3C8F7A1AE768C2798827EA93D7ACAB
                                                                                                                                                                    SHA-256:21883A9BBFB420DB05542112FB39D2C358C1B2A28AF1F30EBA8E89572F71E500
                                                                                                                                                                    SHA-512:0294213C478F77EAC6625B767413E2D639DA006B385593B063DE8B24FA84B5CDC5DC2F4A4FDFB5E70104DE05ED7BA180665C108358F8EBF8ADD1F9D40FFA1BE5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PrPYRd,Rkm0ef,SCuOPb,STuCOe,SpsfSb,UUJqVe,Uas9Hd,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bSspM,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,lsjVmc,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ltDFwf,Rusgnf,Ctsu,UPKV3d,bPkrc,W2YXuc,pxq3x,IZ1fbc,kSPLL,qPfo0c,yRXbo,bTi8wc,ywOR5c,PHUIyb"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ltDFwf");.var Msb=_.y("ltDFwf");var fV=function(a){_.J.call(this,a.Ha);var b=this.oa();this.pb=this.Qa("P1ekSe");this.mb=this.Qa("cQwEuf");this.da=b.getData("progressvalue").number(0);this.ja=b.getData("buffervalue").number(1);this.Ca=b.zb("B6Vhqe");this.Ma=b.zb("juhVM");this.ta=b.zb("D6TUi");this.aa=b.zb("qdulke");this.La=0!==this.da;this.Ka=1!==this.ja;this.Fa=[];this.ea=_.Qs(this).Zb(function(){this.Fa.length&&(this.Fa.forEach(this.E8,this),this.Fa=[]);this.La&&(this.La=!1,_.pr(this.pb,"transform","scaleX("+this.da+")"));this.Ka&&.(this.Ka=!1,_.pr(this.mb,"transform","scaleX("+this.ja+")"));_.Nr(b,"B6Vhqe",this.Ca);_.Nr(b,"D6TUi",this.ta);_.Nr(b,"juhVM",this.Ma);_.Nr(b,"qdulke",this.aa)}).build();this.ea();_.ph&&_.Qs(this).Zb(function(){b.ob("ieri7c")}).Ae().build()();_.Jz(this.oa().el(),this.Sa.bind(this))};_.A(fV,_.J);fV.Ba=_.J.Ba;.fV.prototype.Sa=function(a,b){Nsb(

                                                                                                                                                                    Chrome Cache Entry: 856

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 15860, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):15860
                                                                                                                                                                    Entropy (8bit):7.988022700476719
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:S7qmPTF4N21t//YW2FS6+1XxrsbGmjlAbvqMmtCN:S621tHY4xwbGmjloSM7N
                                                                                                                                                                    MD5:E9F5AAF547F165386CD313B995DDDD8E
                                                                                                                                                                    SHA1:ACDEF5603C2387B0E5BFFD744B679A24A8BC1968
                                                                                                                                                                    SHA-256:F5AEBDFEA35D1E7656EF4ACC5DB1F243209755AE3300943EF8FC6280F363C860
                                                                                                                                                                    SHA-512:2A71EDB5490F286642A874D52A1969F54282BC43CB24E8D5A297E13B320321FB7B7AF5524EAC609CF5F95EE08D5E4EC5803E2A3C8D13C09F6CC38713C665D0CE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
                                                                                                                                                                    Preview:wOF2......=...........=..........................d.....^.`.. .H..<........8........6.$.... ..~. ..)..~E......6..J..`.. :.....8.;..5......!.l.j.%SX.SDm...RXh...&.X......5..._...............@...8...Gi..g.;9..'.Q......1..5.U.....w.+.hn..........c.....5.#{..%.#.JP*..i.J..U(.6.D5V.<"Ex6"...k..[..{.?.d2....{.........*W.......S...hT,.l..'.9.;[@..._.L..|+...)......S...9F......T..t...-=X.:FtZ..uZ.[.?..f<.....@.....'...I...e..........8.?..-R.3,%X...I2|.Wk{i...V2C....H$.H.LH.{.........(...6U..%W[t.R....j.........iS..%..L....rf.=..7..9i.I...1.Mj..C..u.B.........vJ.....+.u$.=..3..T..R.._.gs...6).$.-.PUH..Hl....WDd.......fK.(B.F1>..5.._[..]}VA#X...c.....%.(s50...m...^...1...'.$U*H.t...H...s.AZu...'...8.p...@.@.....q..Y.#.....#.....G.....G@..o8. A........:.........S.:..N.S.j.....tav.}.9h..s.....he.......{,~k...,eK.z}.......5%G...l.uCK.....V..............m.....U}.Sz..Z.c.{.....:..g......>h..'|Z........a....^.b...o.>...g........f../w'....Ja.o(

                                                                                                                                                                    Chrome Cache Entry: 857

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1527)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):14991
                                                                                                                                                                    Entropy (8bit):5.444433315291858
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:ZlS0EjmIMEsYGWLoJo2QFKfnuRBwgm8g0S94dMJ9jH5f/GfAg8NI:U7XxLWzQFK/mWg7g0XE3g
                                                                                                                                                                    MD5:FDC9B5A35CD74FFF3EA372B1A0027A72
                                                                                                                                                                    SHA1:F1E0E8E7924716986E31BF52B3FCA9FB0B781638
                                                                                                                                                                    SHA-256:987EB7DEB2211F6BCB391972114E1C5EE71799B5086F53F1125883F18DCF6CBF
                                                                                                                                                                    SHA-512:F19535F91DE11CAB1AE3D6ACED695A372F23D96941A58BE0CB68F64C8AE901928158BCFC812F21A1F3D7E3CA1FE8892E24A4AD3F4F1A5AFABA6A0555B145E7CE
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/network.vflset/network.js
                                                                                                                                                                    Preview:(function(){function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof n&&n];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var p=ba(this);function r(a,b){if(b)a:{var c=p;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&l(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}function c(f,h){this.g=f;l(this,"description",{configurable:!0,writable:!0,value:h})}if(a)return a;c.prototype.toS

                                                                                                                                                                    Chrome Cache Entry: 858

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 15920, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):15920
                                                                                                                                                                    Entropy (8bit):7.987786667472439
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:sShqOXQlaSchOwK0uFvRqq3xR/xb5OY3aU/lHS9WE2YeK1os:sShJKaScJK0uFvRvxb5OY3aU/lHkmK
                                                                                                                                                                    MD5:3A44E06EB954B96AA043227F3534189D
                                                                                                                                                                    SHA1:23CEF6993DDB2B2979E8E7647FC3763694E2BA7D
                                                                                                                                                                    SHA-256:B019538234514166EC7665359D097403358F8A4C991901983922FB4D56989F1E
                                                                                                                                                                    SHA-512:FAB970B250DD88064730BD2603C530F3503ABB0AF4E4095786877F9660A159BF4AD98C5ABEA2E95EB39AE8C13417736B5772FCB9F87941FF5E0F383CB172997F
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
                                                                                                                                                                    Preview:wOF2......>0.......T..=..........................d.....^.`.. .\..<.................6.$.... .... ..S.!.%c.......|y...6..;.s#.....x_<..o..........l...J.`p.m..6...h....U.pD...R.J.$...W..`7w...[..qD....<P......J.x.+J-^....va...:.KW..Ph...."....{.W4C....p..1..........CH.....P.............Q%.=.F.....1.%J....d..X..J.<AU..b.N...<l...d...f..^Y..]..&...VQ.<.....F..{.....&{.+J;.... .2P.:.*5..?.o.|....V[t..M..#..d.fv...........4..`.).h..h......@u........4......~.....r.B...p1.P.T..<....r....Y..8...GQ1.t.....%..-Wh..:W.....1l-...@..hL}...lN.._.j...D`..sn.=(...W..?.Z..p.52..H...X...)..CJ...V..*7.....<|..i...{...R.M+[..|..x-..M3...~!\.l6}.T.o.R'$.)..-.W.T....A...5?.{.2.bR.../....*l..;...{..I>.n..MJ.2........U&. ..(L]].%P.$..p59.LD.f.........V.....z.5~.2\......#.4....9_....%wp.OU.0.....CK..../.x. ..A2e...@...(.i..f./.....`1.......!......@....0 vbt.e v./!...N=>:..A...(...f....?.....iH.F..!k.6.O6S..54.^c..2.G.?6....)b......lv.,h....Y.}.?..uk....L.4d.g..6.\.1u..

                                                                                                                                                                    Chrome Cache Entry: 859

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ISO Media, Apple iTunes ALAC/AAC-LC (.M4A) Audio
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):6636
                                                                                                                                                                    Entropy (8bit):4.762377523885447
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:96:Gm6G1ItjXwOJvVLATqcQLSIt8xmumUu1ixHRs:j60I1BJvNPcQH8xmumUuixHRs
                                                                                                                                                                    MD5:B3C466B2D513DB8CCD0F4D7C4648E05B
                                                                                                                                                                    SHA1:6BC28BFDBA5C7DF8B455A3B88D4C4D9523CCA860
                                                                                                                                                                    SHA-256:4B4A165585BBA9DA803F7BE0C0F06EA2B97BC1C61B4BF6921AD44E8C6369BF2F
                                                                                                                                                                    SHA-512:43B6E557980C00C5EBA6D5729E7865DF82707D9611477FB2E3EC271C7EB19ED6870723F68ADDBE254D7867DA5FE89ADD8F10BA2AFD75C2B101140FD3F6F8C891
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/search/audio/success.mp3:2f6fcabbd44d8b:0
                                                                                                                                                                    Preview:... ftypM4A ....M4A mp42isom........moov...lmvhd.............D..T.................................................@...................................trak...\tkhd....................T.................................................@...............mdia... mdhd.............D..T.U......"hdlr........soun.................[minf....smhd...........$dinf....dref............url ........stbl...gstsd...........Wmp4a.........................D.....3esds........"........@.............................stts....................stsc.......................hstsz...............................................n...f...`...k...j...f...h...a...i...e...i...b........stco................udta....meta......."hdlr........mdirappl.............oilst.....nam....data........got_it....cpil....data.............pgap....data.............tmpo....data.............(.too... data........iTunes 12.3.1.23....----....mean....com.apple.iTunes....name....iTunSMPB....data........ 00000000 00000840 000002AB 0000000000004915 000000

                                                                                                                                                                    Chrome Cache Entry: 860

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:PNG image data, 21 x 443, 8-bit colormap, non-interlaced
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):2709
                                                                                                                                                                    Entropy (8bit):7.294716766111
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:ER5up9Lr/oQET0V7qvnfQk8/AxxUgh/q3CfbR:ER5up9Lr/NETw7qff0ojUk/qSR
                                                                                                                                                                    MD5:B74CB0A4CB4BAFCE841150BDA3C4A2DC
                                                                                                                                                                    SHA1:F4B862F729048AE3211604EE6DD5221035E645B0
                                                                                                                                                                    SHA-256:71CCCCBA7CFFCCF76FED7EAC96B2CBC2A4FDB24FFECC80EBA0007CBAFD3A726A
                                                                                                                                                                    SHA-512:D47BFE0A4882BD4C3A5E798CABC72D64BD338C68A95BEA72112D5DD8DDC156BC9ACB682997F1F6F6D87E01E85B2835674C6AF289262AC6CAAB98D3AA49BF8A64
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yq/r/X7rXxAUr6Si.png
                                                                                                                                                                    Preview:.PNG........IHDR.....................PLTEGpL.............................................................................................................................................................................................................................................................................................................................................................................................*m.5....tRNS.....>....Z$..........@\t...d....J..V...|D..*..X.P.....(.f....."<..N.`...2..,.B...F.T.4H.R....p~r.^.l L0....b.&j86..hn.x.:v.z.6.A...EIDATx^...S.I....hF#...!..@..s...&...s^..xw..~.iM......V.[...S......... ...-L;.i.A...B.I.+A..Q..eA..*..5....['~.7....0J.....~..&...nj.B.........f.......0..../tW...A.J...S...S./.....j5-........,.........Bp...k...5~.s=.|...5K...R\5.i.o...oU..H.2..GK...#Aw...m{...uT..:..0.W.V.QH......f..j.,.R.......&.......?.....c:DD..HC...uU.[.*.h..Q..t./../.[.C7QKg.V..........5ID..?._.O5@.9.k........e.^.x.2...DE.H4|.

                                                                                                                                                                    Chrome Cache Entry: 861

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with no line terminators
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):52
                                                                                                                                                                    Entropy (8bit):4.542000661265563
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:yVkxzNDrMKcwVbF7KnZ:yVkxtkwVbF7KZ
                                                                                                                                                                    MD5:B3B89B9C275343BC6798E3A83564FDDB
                                                                                                                                                                    SHA1:32367475C527C3F5E5DB0BF42C348816FF4D157B
                                                                                                                                                                    SHA-256:900FB968F7FD9EA55F600AC9002A89E56AB56597DA7BDE04DEAAE6CC77AEB276
                                                                                                                                                                    SHA-512:ADB6938104E802B0936630B216CDE732F21ECA6E60E7A31D1B9C8FF52B5A66A712A7ECDE3F8ED4915D15C0A71C33A9788060E1E22999094C39020A1F8C636874
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISHgmA6QC9dWevzxIFDRkBE_oSBQ3oIX6GEgUN05ioBw==?alt=proto
                                                                                                                                                                    Preview:CiUKDQ0ZARP6GgQIVhgCIAEKCw3oIX6GGgQISxgCCgcN05ioBxoA

                                                                                                                                                                    Chrome Cache Entry: 862

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):315
                                                                                                                                                                    Entropy (8bit):4.648861696465887
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4slhohC/vmI4LIPGDQyIlOWLVJ1WnkX2Wtti0+DrTwtDZi:t4noU/vmRLIO8yIlVVuPWI0gTGQ
                                                                                                                                                                    MD5:9F40343399D2331A8E5DE01251A1F258
                                                                                                                                                                    SHA1:FF3A3A2AB18BAFA30B09E09A083C3699263A10FC
                                                                                                                                                                    SHA-256:CB4F6AB460370D669DE4694A4FB0090C3FADBCDB8C395C813A0680C90C29BFF3
                                                                                                                                                                    SHA-512:3F888927E6DE57D021AA124C5894CAFB54BEE195047D12AB55FDED7C6444AB14C3CE4F3DCAB9E9D06E785EA82FC7A96BE4EAAB6639BF721FF6F698D8760486ED
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/mic/v8/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="M12 3c-1.66 0-3 1.37-3 3.07v5.86c0 1.7 1.34 3.07 3 3.07s3-1.37 3-3.07V6.07C15 4.37 13.66 3 12 3zm6.5 9h-1c0 3.03-2.47 5.5-5.5 5.5S6.5 15.03 6.5 12h-1c0 3.24 2.39 5.93 5.5 6.41V21h2v-2.59c3.11-.48 5.5-3.17 5.5-6.41z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 863

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (16083)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):655354
                                                                                                                                                                    Entropy (8bit):5.73737210338677
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:aMY057YvxAWjm/CXHc7MoEq9u2jCJy/q4IsjFJS+3fFyWxvkTIJcII1:a1057YvxApocg2jBjXS+ty8vG1
                                                                                                                                                                    MD5:C30E9DFC69C6F3251FF3D099D2717B1E
                                                                                                                                                                    SHA1:F622EAE485296FE6FE99E8BB892326F2F3EEE70E
                                                                                                                                                                    SHA-256:E05F2C6F3B9D7595D202D203CC9110B99BF9BF96503B509E0ED3BD87D8CFB715
                                                                                                                                                                    SHA-512:20398E01F6B0B2B8BC7C6E7BFFB8149AF96F7073B4C3EDB023F0EC0898009D48FF1C24BF731F592ACD955DE78F30BA850E9888E46C37E32DF4B353F68139F744
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                    Preview:"use strict";_F_installCss(".Mh0NNb{background-color:#323232;bottom:0;box-sizing:border-box;box-shadow:0px 6px 10px 0px rgba(0,0,0,.14),0px 1px 18px 0px rgba(0,0,0,.12),0px 3px 5px -1px rgba(0,0,0,.2);color:#fff;display:flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;flex-direction:column;font-size:14px;left:0;min-height:48px;position:fixed;right:0;transform:translate(0,100%);visibility:hidden;z-index:99999}.M6tHv{-webkit-box-align:center;box-align:center;align-items:center;align-content:center;display:flex;-webkit-box-orient:horizontal;-webkit-box-direction:normal;flex-direction:row;min-height:inherit;padding:0}.aGJE1b{box-flex:1;flex-grow:1;flex-shrink:1;line-height:normal;overflow:hidden;padding:14px 24px;text-overflow:ellipsis;word-break:break-word}.x95qze{align-self:center;color:#eeff41;box-flex:0;flex-grow:0;flex-shrink:0;float:right;text-transform:uppercase;font-weight:500;display:inline-block;cursor:pointer;outline:none;padding:14px 24px}.KYZn9b{background-color:#

                                                                                                                                                                    Chrome Cache Entry: 864

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):623
                                                                                                                                                                    Entropy (8bit):4.2763238556132555
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:12:t4novnl/naqvgL2IUptn5oPNL8zABU8mNtirRO6W2haEcyVToar94gy5kmluUVF0:t4ovnx8L2IUpJmPNL8EBENElW2haG9rH
                                                                                                                                                                    MD5:4DAF8785182AC1E5611B71758B96C865
                                                                                                                                                                    SHA1:D065E53E7D208101346CEA65C9F021B3FD4CE45C
                                                                                                                                                                    SHA-256:E8AECC1EE2FE7D415AD9EC08091D21A88B0B98CB91703534962C3A919A7E11A5
                                                                                                                                                                    SHA-512:34AC148520872D75A4784DBAFCCDEA453C3E45479BC41E73335865138AFBD5D9196D38400B0CCAF16C43C45947296AC057E136BF7DB444CCB0D141D3B6049C0B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/radar_live/v6/16px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="16" viewBox="0 0 16 16" width="16"><path d="M9 8c0 .55-.45 1-1 1s-1-.45-1-1 .45-1 1-1 1 .45 1 1Zm1.11 2.13.71.71C11.55 10.11 12 9.11 12 8c0-1.11-.45-2.11-1.18-2.84l-.71.71c.55.55.89 1.3.89 2.13 0 .83-.34 1.58-.89 2.13Zm-4.93.71.71-.71C5.34 9.58 5 8.83 5 8c0-.83.34-1.58.89-2.13l-.71-.71C4.45 5.89 4 6.89 4 8c0 1.11.45 2.11 1.18 2.84Zm7.05 1.41.71.71C14.21 11.69 15 9.94 15 8s-.79-3.69-2.06-4.96l-.71.71C13.32 4.84 14 6.34 14 8c0 1.66-.68 3.16-1.77 4.25Zm-9.17.71.71-.71C2.68 11.16 2 9.66 2 8c0-1.66.68-3.16 1.77-4.25l-.71-.71C1.79 4.31 1 6.06 1 8s.79 3.69 2.06 4.96Z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 865

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1631)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):38670
                                                                                                                                                                    Entropy (8bit):5.380711749535656
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:LqHPXEe8NFLsDRpwubi6jdNUOFbBPkvYm9Xt/x4ihUkZb+qkzu8seK1:HRyiENUgkvYm9Xtp4BkHT
                                                                                                                                                                    MD5:6D2889D0B8C5F4817D4571D1FC489AE8
                                                                                                                                                                    SHA1:5051BA7A37B26A4169FEB76F078B7DB182E6EDF3
                                                                                                                                                                    SHA-256:F1C724F7FA58D9DAC65B1B24762BF0E0B1C0946E79D938672925398648BA7672
                                                                                                                                                                    SHA-512:B3CC68B18C8D044DB18EAAFB5ACEF029B90D51610D8BFF7CCF7D40684EEE42A34FBDD53EA4496502FDD613B327C99771C83AE4FBF012B77098D1000D3AEA180B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Tna=function(a){var b=0,c;for(c in a)b++;return b};_.Una=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ma(a)||"string"===typeof a?a.length:_.Tna(a)};_.lo=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map||"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ma(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.yb(a)};._.Vna=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg||"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ma(a)||"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.zb(a)}}};.var Wna,Zna,Yna,Xna,Bo,Do,koa,boa,doa,coa,goa,eoa;Wna=function(a,b,c){if(b)re

                                                                                                                                                                    Chrome Cache Entry: 866

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (663)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):3238
                                                                                                                                                                    Entropy (8bit):5.430358322799373
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:o7FCVmOGkPvrDDzY/HwdNQ8jsu8x0fjYpId6Xt63US1+xdl59rw:osVMsriQdODWgIdatKUhw
                                                                                                                                                                    MD5:A9A9D3B9EE6F73FFCCF8140781E3CC78
                                                                                                                                                                    SHA1:0F5F34F5908BBB504729414E1301BBE047BB4FC4
                                                                                                                                                                    SHA-256:13FDE2D88756D918A795D1CD2A2B0B67C375003B2B6FF37794B60EFEE3242AA1
                                                                                                                                                                    SHA-512:FB22FE047A21C67D1034335F7289EE009562E15713573B0E676E20C267F9AE94B804664CB9DF6523A259E179ADA5F451745ECDC24EF042F30021B2B749D5821D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Gw=function(a){_.I.call(this,a.Ha)};_.A(Gw,_.I);Gw.Oa=_.I.Oa;Gw.Ba=_.I.Ba;Gw.prototype.rM=function(a){return _.gf(this,{Xa:{DN:_.vk}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.qi(function(e){window._wjdc=function(f){d(f);e(PCa(f,b,a))}}):PCa(c,b,a)})};var PCa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.DN.rM(c)};.Gw.prototype.aa=function(a,b){var c=_.Dra(b).Xg;if(c.startsWith("$")){var d=_.Vm.get(a);_.Jq[b]&&(d||(d={},_.Vm.set(a,d)),d[c]=_.Jq[b],delete _.Jq[b],_.Kq--);if(d)if(a=d[c])b=_.ff(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.yr(_.Lca,Gw);._.l();._.k("SNUn3");._.OCa=new _.gl(_.og);._.l();._.k("RMhBfe");.var QCa=function(a,b){a=_.Ypa(a,b);return 0==a.length?null:a[0].tb},RCa=function(){return Object.values(_.Gp).reduce(function(a,b){return a+Object.keys(b).length},0)},SCa=function(){return Object.entries(_

                                                                                                                                                                    Chrome Cache Entry: 867

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):111
                                                                                                                                                                    Entropy (8bit):4.980379097367065
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:tIsqDmJS4RKb5KVErcHgDXFUVLUJRVFiAdFUvuII9rP0WTC:tI9mc4slmgSVLU9FRF0ul5TC
                                                                                                                                                                    MD5:7A85DE03D089077BC1F895B1EA91907F
                                                                                                                                                                    SHA1:B86AF0404FED40A12228084B3B090DF8DBE50C0B
                                                                                                                                                                    SHA-256:179FAF7C791CF27682668324B60182039191B22B3AC85069C8BEBBA418DB9A1D
                                                                                                                                                                    SHA-512:8669E2B41453760B0C67C0701C4EFB4DCF6F544FDB84259383B5E9C64DA4E99DA37CDEC717ECC02E7BB919390E8187877EA125C367456C94B0245BD04E7FB4D4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/keyboard-arrow-up/v1/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg"><path d="M7.41 15.41L12 10.83l4.59 4.58L18 14l-6-6-6 6z"></path></svg>.

                                                                                                                                                                    Chrome Cache Entry: 868

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (19300)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):278055
                                                                                                                                                                    Entropy (8bit):5.408959578340401
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:fPHaQFjDXOlJ/yfJJubY9OD47YzG4HEBuP2IUeOkFCbPIO6I3uclVuYgyi3i8/K5:Bpxm7LP2IqnS9m5gcSDOOa
                                                                                                                                                                    MD5:AD577CF3083706281532A3478DACBFCB
                                                                                                                                                                    SHA1:E628DBB345AC293CB45FEE49653579768A24AB62
                                                                                                                                                                    SHA-256:ED08FBA5D572965F93748F48921F7ADCB85C5213AF68F8CF7604816056DBC03C
                                                                                                                                                                    SHA-512:0064D6C6CB20A03C8609981B2F8E4371168C4E47AA4F6687163441B3D54F558F2D4A1AD32B31D9CAFE9EF1F35521584121F4ACC0B01FE702E6822A455ECE3C6B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yb/r/lbht4Yc1LMV.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/.."use strict";(function(){var a=typeof globalThis!=="undefined"&&globalThis||typeof self!=="undefined"&&self||typeof global!=="undefined"&&global;if(typeof a.AbortController!=="undefined")return;var b=function(){function a(){this.__listeners=new Map()}a.prototype=Object.create(Object.prototype);a.prototype.addEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();d.has(e)||d.set(e,new Map());var f=d.get(e);f.has(b)||f.set(b,c)};a.prototype.removeEventListener=function(a,b,c){if(arguments.length<2)throw new TypeError("TypeError: Failed to execute 'addEventListener' on 'CustomEventTarget': 2 arguments required, but only "+arguments.length+" present.");var d=this.__listeners,e=a.toString();if(d.has(e)){var f=d.get(e);f.has(b)&&f["delete"](b)}};a.prototype.dispatchEvent=function(a){if

                                                                                                                                                                    Chrome Cache Entry: 869

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):66256
                                                                                                                                                                    Entropy (8bit):7.9795477395400045
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:fUJxsw5X7RU1Mv8fWff8gBEBtfFzFD0hNcsC/1j92tXkf:fUJxNJ61ZeMgyBtKN6It0f
                                                                                                                                                                    MD5:AA9286FB0A3725D6F0054622ECF16ECB
                                                                                                                                                                    SHA1:E13D15DB094C457DC01153D2520D9FA25BB6EF56
                                                                                                                                                                    SHA-256:A461DC1F2F1EFD8BD8AE21CDD40F37F8523049E7DB5662F0AD973F39BF7907AE
                                                                                                                                                                    SHA-512:69F8C2F930950A93B040F99BA087B1B4D602EB605070B0967CA83E6FA02199F88B30813CBDA08D67BA642FD9793749160EBDD9802EBF112512CE067DD1F427DB
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/423453396_760079948980319_6762375072864353045_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=KVtXdj6qvhcAX_VYHRB&_nc_ht=scontent-atl3-2.xx&oh=00_AfCkQ-Fo_w23WT-UDSgio7dTKp_L-C_tIuLtjMEyI0HDJw&oe=65CFB957
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000fa220000684d0000075900007e5e00003f6c00006b9a00009da0000096ab000000b40000d0020100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."................................................................................wC...-kx:...t.E..]VA...O...4.k.M-..&.Q.9x........\.....x........Gwe.....V./"...!....0_.#..]..LOc.1.wv.mV..f.Q..[.X.o-..G...Eo.R-FfZE.....z...Uby..=.f$.....=.Mg3M$..J2.u".j.&.....n.c.=.Lv.(H..u....KA..@az|.wKF&x..q...u.lJ.O.t. ....;.J...(<..X..l.c.j..a-...v.;.X..|....^..N.l..o.'.VbH3I...tN..U.O.N.nN.&bq......v.....?.2/":.ij|.f%.n..X.Jwwe...wQy{^(..Ry..l.Q.S.Hi.,.b.4V. e....._Ha0.4..qGZF._.......wq[0.V.\&...<...t?.11..gn..k1b.......Ou..U}..\M.j.......'.....<.]M...8.....@.![.3.r7Z..3Y..z.9.b.@Y..2p.i..........J.u....Q.Q....=4.#BR.7GqI..{.6.W..........oE.3Tu#...W..fx=z.DZ...Q...ef.....~.p....;..

                                                                                                                                                                    Chrome Cache Entry: 870

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (65405)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):8456788
                                                                                                                                                                    Entropy (8bit):5.62070975385235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:49152:eCAgZKqK0qsGd/X8YqVjPpcS7JSdqav2YIUQpm0kMza53clEAX/Hs+hbw6IY+7EP:zPz7J3fkbB6Jtdj
                                                                                                                                                                    MD5:26C5A83E82A8D8B2854182972A0288DE
                                                                                                                                                                    SHA1:C3C536988E8AC178280A20A9F44CEA08A61D820F
                                                                                                                                                                    SHA-256:F4F749321A3CA4C06D65A5C5C9945A91708F3414B7B94DBE035A9CADCF126652
                                                                                                                                                                    SHA-512:E4FED55DF2307F917B0C13624D41C09EC3CC727A1DB7063FD3DCE0C77EF024E31442DFD3450ABAF942996E7C9DC8EDD624C9787BB0ED959F1F0496B81ECF2F62
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/desktop_polymer.vflset/desktop_polymer.js
                                                                                                                                                                    Preview:(function(){./* HTML content inlined from HTML import */.const d=document.createElement("div");.d.setAttribute("inlined-html","");.const finalStyleText="html:not(.style-scope) {\n --primary-text-color: var(--light-theme-text-color);\n --primary-background-color: var(--light-theme-background-color);\n --secondary-text-color: var(--light-theme-secondary-color);\n --disabled-text-color: var(--light-theme-disabled-color);\n --divider-color: var(--light-theme-divider-color);\n --error-color: #dd2c00;\n --primary-color: #3f51b5;\n --light-primary-color: #c5cae9;\n --dark-primary-color: #303f9f;\n --accent-color: #ff4081;\n --light-accent-color: #ff80ab;\n --dark-accent-color: #f50057;\n --light-theme-background-color: #fff;\n --light-theme-base-color: #000;\n --light-theme-text-color: #212121;\n --light-theme-secondary-color: #737373;\n --light-theme-disabled-color: #9b9b9b;\n --light-theme-divider-color: #dbdbdb;\n --dark-theme-background-color: #212121;\n --dark-theme-b

                                                                                                                                                                    Chrome Cache Entry: 871

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (516)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):9642
                                                                                                                                                                    Entropy (8bit):5.435855411923511
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:flejPRjM65ile/Q0Y5CaNLMASVZkXK7aACjbN9LDXxdZ7G92tXL74dESC:1oURjwgXK7aAq9LDXxdZ7G0tXL74dESC
                                                                                                                                                                    MD5:DAC3D45D4CE59D457459A8DBFCD30232
                                                                                                                                                                    SHA1:946DD6B08EB3CF2D063410F9EF2636D648DDB747
                                                                                                                                                                    SHA-256:58AE013B8E95B7667124263F632B49A10ACF7DA2889547F2D9E4B279708A29F0
                                                                                                                                                                    SHA-512:4F190CE27669725DAC9CF944EAFED150E16B5F9C1E16A0BBF715DE67B9B5A44369C4835DA36E37B2786AAF38103FDC1F7DE3F60D0DC50163F2528D514EBE2243
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/scheduler.vflset/scheduler.js
                                                                                                                                                                    Preview:(function(){'use strict';var g;function h(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var k="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype||a==Object.prototype)return a;a[b]=c.value;return a};.function aa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var l=aa(this);function m(a,b){if(b)a:{var c=l;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&k(c,a,{configurable:!0,writable:!0,value:b})}}.m("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c(d+(f||"")+"_"+e++,f)}.function c(f,y){this.g=f;k(this,"description",{configurable:!0,writable:!0,value:y}

                                                                                                                                                                    Chrome Cache Entry: 872

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):18286
                                                                                                                                                                    Entropy (8bit):7.9641935622400135
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:8d7/OdV8FGSCVe/pUaDBvyzBQTagcrR1Gsb2K:8UdV8UVK7B6zLPtr
                                                                                                                                                                    MD5:130E9ED324006D75B5C46BD727735A83
                                                                                                                                                                    SHA1:8BE4C63BE96371EEDC6D6821CF91F2F1314B2B40
                                                                                                                                                                    SHA-256:1609A7A1C75C7DFB17BC1C70272B7D96E1E044D90A03AC1BC05940FB3E3F82A6
                                                                                                                                                                    SHA-512:88DF0D14D84DDC1FBFA4550A6FA81CB1A67CEBECAAAE812EF7B92A110EE576DF33B90667AFB580EFEA1A2C20F2E3EB21A96D22F9AD7983296AC7C9DBDC3ED9D6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426433987_295042899895392_1651009096373061368_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=ruP7NC0srFYAX_jJLLN&_nc_ht=scontent-atl3-2.xx&oh=00_AfCwLRNEpW4LLdzOkxZU-Rp3C47LT7juOiieSu6-M23veQ&oe=65CE8C88
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6f01000019060000670f0000f70f0000ca100000fb1b0000132b00002b2c0000182d00001f2e00006e470000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n...."..............................................................................r<R1..<.'.qTb..<P..K.PO,:.......JF......h.. .....JX.$pP7......hf... $.)kG_]c.B.4......&tN%. ....Z......K..A.A.t.[.1..q...(..nT.m-.V.?5[..9...>...$....(.%o1."..wc..JF..Y.2...t.'-..7U..Q..X.F.E.....<?D...).t.w.2.......D..u.i............7.F?........;.>...$k...X...`...Y..6.T.Fr..#N".q.I.p......y.e/ku=c..cC..Z{.K...+..#.i.[...+...8.K.d..V.By\.k}...O#7.mj%j.o..;.8.df.D..k....X..sJ{1.....8.V`.....lz...?.xy.....*..Yp]..^x...(T....Lvl.....[s..!cY..@.....3..n\.w.U..c.'..c{.#!"...P..:...{...g...\....-..E.AQ...?~.;.t.}.z-4.[o<..v.....;.....wY....Yp......;"z..z&c..k"L..U...

                                                                                                                                                                    Chrome Cache Entry: 873

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 15552, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):15552
                                                                                                                                                                    Entropy (8bit):7.983966851275127
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:HDKhlQ8AGL0dgUoEGBQTc7r6QYMkyr/iobA2E4/jKcJZI7lhzi:jslQ+LhUoTB0Qr6Qjkg/DmcJufzi
                                                                                                                                                                    MD5:285467176F7FE6BB6A9C6873B3DAD2CC
                                                                                                                                                                    SHA1:EA04E4FF5142DDD69307C183DEF721A160E0A64E
                                                                                                                                                                    SHA-256:5A8C1E7681318CAA29E9F44E8A6E271F6A4067A2703E9916DFD4FE9099241DB7
                                                                                                                                                                    SHA-512:5F9BB763406EA8CE978EC675BD51A0263E9547021EA71188DBD62F0212EB00C1421B750D3B94550B50425BEBFF5F881C41299F6A33BBFA12FB1FF18C12BC7FF1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2
                                                                                                                                                                    Preview:wOF2......<...........<Z.........................d..z..J.`..L.\..<.....<.....^...x.6.$..6. .... ..S..}%.......|....x..[j.E...d..-A...]=sjf$X.o.5......V....i?}.\...;...V......5..mO=,[.B..d'..=..M...q...8..U'..N..G...[..8....Jp..xP...'.?....}.-.1F.C.....%z..#...Q...~.~..3.............r.Xk..v.*.7t.+bw...f..b...q.W..'E.....O..a..HI.....Y.B..i.K.0.:.d.E.Lw....Q..~.6.}B...bT.F.,<./....Qu....|...H....Fk.*-..H..p4.$......{.2.....".T'..........Va.6+.9uv....RW..U$8...p...........H5...B..N..V...{.1....5}p.q6..T...U.P.N...U...!.w..?..mI..8q.}.... >.Z.K.....tq..}.><Ok..w.. ..v....W...{....o...."+#+,..vdt...p.WKK:.p1...3`. 3.......Q.].V.$}.......:.S..bb!I...c.of.2uq.n.MaJ..Cf.......w.$.9C...sj.=...=.Z7...h.w M.D..A.t.....]..GVpL...U(.+.)m..e)..H.}i.o.L...S.r..m..Ko....i..M..J..84.=............S..@......Z.V.E..b...0.....@h>...."$.?....../..?.....?.J.a,..|..d...|`.m5..b..LWc...L...?.G.].i...Q..1.:..LJV.J...bU.2.:\.kt.......t.....k....B..i.z+...........A.....

                                                                                                                                                                    Chrome Cache Entry: 874

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:HTML document, ASCII text, with very long lines (682)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):4119
                                                                                                                                                                    Entropy (8bit):5.341681213096119
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:veQDGADGAkzVb7eZphVk/8uO6SWVHXG2XGfXdQFWqLJFldysb7IlwPeGEu9CyNnI:GHdBbgpKXO6757UtPAddyqE0BUIw
                                                                                                                                                                    MD5:31FB1DE7C9975E6514EDFE28D7DB1FE7
                                                                                                                                                                    SHA1:BECAB9E40A21A4B9E49CC0911C52D2FC58EA7754
                                                                                                                                                                    SHA-256:F1FAA8FCE74038DAFC13260C1884CDDF1A31A7855BA0EAB9C8BDFE32D8292235
                                                                                                                                                                    SHA-512:52E56C4C6DF65DC62F4DEE0DEF636D37B6112CE588851BD2B7CB88BCC9240A2F48088A4CB6655E549FA610E5CBB4B0096758F6EC4D78AD861E1B6B5B2831A4B5
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=A7fCU,AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,VwDzFe,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,bm51tf,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,w9hDv,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=NTMZac,sOXFj,q0xTif,ZZ4WUe"
                                                                                                                                                                    Preview:"use strict";_F_installCss(".N7rBcd{overflow-x:auto}sentinel{}");.this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.ng(_.Pma);._.k("sOXFj");.var Er=function(a){_.I.call(this,a.Ha)};_.A(Er,_.I);Er.Oa=_.I.Oa;Er.Ba=_.I.Ba;Er.prototype.aa=function(a){return a()};_.yr(_.Oma,Er);._.l();._.k("oGtAuc");._.nsa=new _.gl(_.Pma);._.l();._.k("q0xTif");.var mta=function(a){var b=function(d){_.Sm(d)&&(_.Sm(d).oc=null,_.Sr(d,null));d.XyHi9&&(d.XyHi9=null)};b(a);a=a.querySelectorAll("[c-wiz]");for(var c=0;c<a.length;c++)b(a[c])},ds=function(a){_.cq.call(this,a.Ha);this.Ra=this.dom=null;if(this.Xh()){var b=_.il(this.Bf(),[_.Nl,_.Fl]);b=_.si([b[_.Nl],b[_.Fl]]).then(function(c){this.Ra=c[0];this.dom=c[1]},null,this);_.rr(this,b)}this.Ma=a.nh.v7};_.A(ds,_.cq);ds.Ba=function(){return{nh:{v7:function(){return _.Wf(this)}}}};ds.prototype.getContext=function(a){return this.Ma.getContext(a)};.ds.prototype.getData=function(a){return this.Ma.getData(a)};ds.protot

                                                                                                                                                                    Chrome Cache Entry: 875

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):157
                                                                                                                                                                    Entropy (8bit):4.866482514263467
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3:tIsqDmJS4RKb5sAR+hHiATcvXjXRHRcBHoNcHLLWQlXI1/ymUwHMQMQtnQSb8:tI9mc4slhohC/vmI4NXa//1RtnQo8
                                                                                                                                                                    MD5:C62423FDC7866B06AF4889BE619900A2
                                                                                                                                                                    SHA1:93BEEE6DEA1F9CB906B794F182949F357AAC06D0
                                                                                                                                                                    SHA-256:C47564ECC26A15C0A2381733FBF821EDFDCC17A4A8B946380B6308C6381517DF
                                                                                                                                                                    SHA-512:4E7CFB526D804C30F4DAED59EA03709BF9D311BF4F30FC090F4032B9C8D12E73789798BD5A5A5AFBE889B009A1BB12E7939577055FC983520E7F93334DABD5EA
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/i/youtube_outline/chevron_down/v7/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg" height="24" viewBox="0 0 24 24" width="24"><path d="m18 9.28-6.35 6.35-6.37-6.35.72-.71 5.64 5.65 5.65-5.65z"/></svg>

                                                                                                                                                                    Chrome Cache Entry: 876

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:SVG Scalable Vector Graphics image
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):324
                                                                                                                                                                    Entropy (8bit):4.519025420255455
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6:tI9mc4sl5RINAvxm6lzjQewRNGBvLl1ZX1i0dTnUMSdR+trpYmQkDEJM:t4vqNAJXpQewC5pDpU6VYFG7
                                                                                                                                                                    MD5:DDABFA57FD16BDBA85E2FD30B2B0FEFF
                                                                                                                                                                    SHA1:9FC8CD1D34223C54E0C86922F2DE68AACBE6E57A
                                                                                                                                                                    SHA-256:B60F66156BC26031D7F02CC7CAAA6D7277D56F1821ED55280F67446AA3643640
                                                                                                                                                                    SHA-512:1AD6D890CADC461D74821065143FBE1AFC882C106ED646F41CB2BC12D00D6FCC6E9C68C7FAA7F260F2FABAFF68689EA0DF48CEA54FF40AF505B4A632D67F1B5B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.gstatic.com/youtube/img/icons/web/youtube_outline/refresh/v1/24px.svg
                                                                                                                                                                    Preview:<svg xmlns="http://www.w3.org/2000/svg">. <path d="M13 9v2h7V4h-2v2.74C16.53 5.07 14.4 4 12 4c-2.21 0-4.21.9-5.66 2.34S4 9.79 4 12c0 4.42 3.58 8 8 8 2.21 0 4.21-.9 5.66-2.34l-1.42-1.42C15.15 17.33 13.65 18 12 18c-3.31 0-6-2.69-6-6 0-1.65.67-3.15 1.76-4.24C8.85 6.67 10.35 6 12 6c2.21 0 4.15 1.21 5.19 3H13z"></path>.</svg>.

                                                                                                                                                                    Chrome Cache Entry: 877

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1802
                                                                                                                                                                    Entropy (8bit):7.115702750310235
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:LjtGiWMeJmfa7jUvNG0JOmz7H/XAq6zX4nZrQ6NxpQ:+JMk0JOmXH4D4nZrQMpQ
                                                                                                                                                                    MD5:2A1B21542135DBDC8DB634B79D1BB616
                                                                                                                                                                    SHA1:07C0EEE06ED689D05914542BF2BC29C775375BF2
                                                                                                                                                                    SHA-256:CB9A3BCB17ED19823343869FF1B9718F306E466D8D8EEA983D8CF57E1F3F939A
                                                                                                                                                                    SHA-512:E63391B644D3BCAD0A3BBEDAD3AB3485ACF79C3F82BA493F4F7C9855A7FC6B1C02A1834A4135FC7842212F9B70537F44F03196D02104C0CB097C48D3A737CC83
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/352371982_934479657809582_7975797767645748400_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=2BG0o-8ftTcAX-UEwy0&_nc_ht=scontent-atl3-2.xx&oh=00_AfD2ZCDwpIXbYFvf-nw41yoW5jkc4LDq0Ypb91DvopeP4g&oe=65CF5EEE
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM..........g..jrW8Qjp08TMhE0iohB46..(.bFBMD0a000a86010000f30100008a020000e10200003c0300004b0400000b05000047050000a9050000f90500000a070000...C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................1....d3..?..."U.R[u.?.....^.V...0.,.6._..............!.......................5...3.!0............R..R.M..FZ......QE.3wA.P.....#....:p....v..m..?.a=s.C(.U.\...:.....N..\~.%(.].!...S..j...6.*&...A..?..."..........................! "1..........?.....IH{B.R.,D...)..q.r...x.b..p.T.N.4..............................A !2........?..;.7...7...\..;j....*P.]..F.....0..........................!1A...."2Qq.#a.$0BRS........?....<E.#]. .kVb.?....A.m..I.,.-.@..S.k..(...D&.4.w...Q..w{.M..?...Xh......I(.`u...l-Bi1.Wu.k...6")p.....t.9..oj.....v...4@..\...Mv...3Ps..E`.#...s.o....H..[..

                                                                                                                                                                    Chrome Cache Entry: 878

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):15344
                                                                                                                                                                    Entropy (8bit):7.984625225844861
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
                                                                                                                                                                    MD5:5D4AEB4E5F5EF754E307D7FFAEF688BD
                                                                                                                                                                    SHA1:06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
                                                                                                                                                                    SHA-256:3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
                                                                                                                                                                    SHA-512:7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
                                                                                                                                                                    Preview:wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h|.l....A....b6........(......@e.]...*:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#*e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.*UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...*$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf*.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed.*.'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

                                                                                                                                                                    Chrome Cache Entry: 879

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (775)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1479
                                                                                                                                                                    Entropy (8bit):5.331655757916403
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:kMYD7xdu06qraNzvbY3Xaut/HTe93HyNP6Iz2hLb5BCo0SGbtEGbQdrOgM8Z4prw:o7xQ06dsXa8e9HsShPCSGbtEGbMN5ZW8
                                                                                                                                                                    MD5:ACD427B5E8D40A6A259595E97AA20988
                                                                                                                                                                    SHA1:6C822109080423888F80E905B8044F2F60435968
                                                                                                                                                                    SHA-256:21DBC6D5229FBFDD9055B0C9828D76D4FEDA69DB331522F9FDE9CE1ACEA74288
                                                                                                                                                                    SHA-512:FE59D1AB2ACFC6BAF487F1FAAD64CD9AC47D0F93018673E68E337BE777E53D882B65EA865242BA615733E1BC9D5D8ABA473A05308341CA1B482DF6CBC51C49C1
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,RMhBfe,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,ZwDk9d,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEhWrJuTvRrAvrbvnWiSefA_g7eCw/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=bm51tf"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("kMFpHd");._.sTa=new _.gl(_.Cl);._.l();._.k("bm51tf");.var vTa=!!(_.Mg[0]>>20&1);var xTa=function(a,b,c,d,e){this.ea=a;this.ta=b;this.ja=c;this.Ca=d;this.Fa=e;this.aa=0;this.da=wTa(this)},yTa=function(a){var b={};_.Na(a.cN(),function(e){b[e]=!0});var c=a.yM(),d=a.RM();return new xTa(a.AJ(),1E3*c.aa(),a.jM(),1E3*d.aa(),b)},wTa=function(a){return Math.random()*Math.min(a.ta*Math.pow(a.ja,a.aa),a.Ca)},VE=function(a,b){return a.aa>=a.ea?!1:null!=b?!!a.Fa[b]:!0};var WE=function(a){_.I.call(this,a.Ha);this.Bc=null;this.ea=a.Ea.ZP;this.ja=a.Ea.metadata;a=a.Ea.f$;this.da=a.ea.bind(a)};_.A(WE,_.I);WE.Oa=_.I.Oa;WE.Ba=function(){return{Ea:{ZP:_.tTa,metadata:_.sTa,f$:_.mTa}}};WE.prototype.aa=function(a,b){if(1!=this.ja.getType(a.Bd()))return _.Ul(a);var c=this.ea.aa;return(c=c?yTa(c):null)&&VE(c)?_.jsa(a,zTa(this,a,b,c)):_.Ul(a)};.var zTa=function(a,b,c,d){return c.then(function(e){r

                                                                                                                                                                    Chrome Cache Entry: 880

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):2232
                                                                                                                                                                    Entropy (8bit):6.900192900253772
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:7dl/ulERziWs11uxEimUAsQTx2bvAW5U0aqm/rKO:Rl/PGUx8ZRhWyEkKO
                                                                                                                                                                    MD5:69DF73F0245B80B6A27425991D6DCED9
                                                                                                                                                                    SHA1:3DC424C965A321DF1A9BF4A440255E3F17D6CEEE
                                                                                                                                                                    SHA-256:789B6F7A0BB6D858A0FDD76662339E4BB6979C006B0EF204CCF4EAB6510A83E4
                                                                                                                                                                    SHA-512:8FEEA674355BA520EBE30F5BB50643D852B290DA1C42CA10EF267664F41550F08898DB319C03F170C3ED4BC84B5D2E93E1BFCE6C0B82D1BDE603DDDFD89FFD2D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/426206912_10231917010127856_9185840565239668802_n.jpg?stp=cp6_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=R91WoWbfuPsAX9vF5lu&_nc_ht=scontent-atl3-2.xx&oh=00_AfA2YQnbWLA4nuTQ3TRuwYojwZ9Uih4jJm4rp0n_EjwUMw&oe=65CF1556
                                                                                                                                                                    Preview:......JFIF..............ICC_PROFILE.......lcms....mntrRGB XYZ ............acspMSFT....sawsctrl.......................-hand.......<.Q.E(z..................................desc.......^cprt........wtpt........rXYZ...,....gXYZ...@....bXYZ...T....rTRC...h...`gTRC...h...`bTRC...h...`desc........uP3.............text....CC0.XYZ .......Q........XYZ ..........=.....XYZ ......J....7....XYZ ......(8.......curv.......*...|.....u.....N.....b.......j.. C$.)j.~3.9.?.FWM6Tv\.d.l.uV~..,.6..........e.w........Photoshop 3.0.8BIM.......h..(.bFBMD0a000a49030000bf0300005f040000a90400000a050000d405000099060000d00600001407000064070000b8080000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2..".............................................................................I.....UM\.Il....0.\..}.Y..[\7.t.AB....cg..V=.>..3&/m.+e..p......._... ...........................!1..............L..C..2..}V.T$x.'..y.`.Z-.

                                                                                                                                                                    Chrome Cache Entry: 881

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1225
                                                                                                                                                                    Entropy (8bit):6.5553847912791605
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:gq/znyc1spQ4JX0+ZP+l4XzcZTqcxYcZ0MlLp0RDN2z:gSLyiWBEgWQctbh0Ml0NU
                                                                                                                                                                    MD5:A1AA6CFA91AF6273434EB55D6B5B62FA
                                                                                                                                                                    SHA1:ED480078210D2D5F0A1AA05A13E90C65673DCC38
                                                                                                                                                                    SHA-256:91960DE132C5D7044879455E0CAAE97F1A79F71ABA8BF2357EBA40AEECDA0B94
                                                                                                                                                                    SHA-512:1EB2EB5913BCEE7DE23E48E698AB63A5E4959151A66208371309A909D1EF0C413C32FFF014D2629586B162607CF757E49AC7276C201DBCA397CDAF194F72D1F8
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/364087113_667752125380566_205790429212624590_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=596444&_nc_ohc=HZHiJE3cafQAX8o-DV8&_nc_ht=scontent-atl3-2.xx&oh=00_AfA5BPKOF5bO_YdqEixjR7JITBsPY3YBwEl7aGqbDcXRqg&oe=65CF0FC8
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000c3010000090200002f0200006d0200000303000071030000a3030000cb03000005040000c9040000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."............................................................................Z..%....uz...c.Q...V.S'^d.K..Y.: d...............................0@...........E....[.l\.q.....^..^..e.`.....[+..o.....................@........?........................... .........?....A..?...+.......................!..."1AQ..023@R...........?...jv[.W.....:.-.. 2.K{..-..i@'f-.y...[ .-.|...s..]..E..l.@A.j... ....)_Z.C...$O..]X....#.Lm.`x..?...."...................!.1A.Qq 0a...........?!....Hwgj..."..r..{..JZ|V..>.."..._+...I$..@.b..o".l..ZUj.....B..H................r.c.z.3....................<>g.|O.q.A....................... ........?..33.......................... ........?..,.A.D.[s^y.....!..

                                                                                                                                                                    Chrome Cache Entry: 882

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):110678
                                                                                                                                                                    Entropy (8bit):7.977913749296834
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:hFkw7d64FUDjjKGk012mx/Xyj4mGxCuv9QCEDStz:hW88ljK1mM4mGxCuv9QCSStz
                                                                                                                                                                    MD5:9085FD741EA97821D3E0FE9BAA0D5AB5
                                                                                                                                                                    SHA1:F5FCA9B332B4979C3287B1C9DBEEB025355612E2
                                                                                                                                                                    SHA-256:E50F676193DFDE2DE0A24366960C226694A1501F3EB60F072777547B927670EE
                                                                                                                                                                    SHA-512:AD909BD7E98776E7E04E84196259014FF9CDB74040AE3BE24CAB900A3D7A532E894200DD1F4572A7C7FBF829F1E04EC711209E3E8F63F4F61847AF26EC44DD21
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426160102_1413847206223091_21682555801147289_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=WIyAn_sKhAIAX-ucvfL&_nc_ht=scontent-atl3-2.xx&oh=00_AfAs7BcWwt_qFqwoiUWLlzYk63XQN2OlJItH-dWspkjpaA&oe=65CF41EE
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000251d00005254000036570000975a000064940000dffa00000f01010023060100890b010056b00100....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...................................................................................Ys.8.K..M!.+f..[M..n..jM..E..h.xS....e..%=..MW+U`.&k..y....!.:.. .f.}....,.......#^.f.."...r......'.g.:...D.>..\H..Y..`e....fsSj..u....#.q-u.D....7.<.....m.r.j."..jhe'.....C....Y;......q.I.A...`....zJ......|g.<fo.vvt..k..4..|.r_m......'.o....^b...r.....F......|....7..d.\..PwZ...Vl....u.F.k..2h.....6M...?;Rj.c...o.c....D..g....z5...{....%.......e.=s.G.../K.U...7=.i}.5?O.......#.aN.q.....PdJq(.....\z......<.....Nlk.*....W.k...7.c7......b..EF}..9z4.5p.K .\.hf..&.s...HgS.....F)..{.24~......L.hy.T.V.t*.=....'.....c#6...d.S.65..*v.l...<c..j.-..m{R^.Xy..fz..|.MzZ.6.]^...,.~w...

                                                                                                                                                                    Chrome Cache Entry: 883

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (16083)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):635109
                                                                                                                                                                    Entropy (8bit):5.7451230924020225
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:6144:ZhYY57MxAWj//C0Hc7MoEq9H2jCJy/q4IsjFJS+3fFyWxvmTIJcII1:ZSY57MxAmPc92jBjXS+ty8vs1
                                                                                                                                                                    MD5:BAB99052C96A7B2D865CB86F02B4AD64
                                                                                                                                                                    SHA1:09C068B52ED85722EBA05B55E0F70D5A29A2208D
                                                                                                                                                                    SHA-256:C77B6E557D0C5B43A7CC4710C8352C1C3087488266EAC3CAC0F89B5E3441C40B
                                                                                                                                                                    SHA-512:58DB4D922F480A9E8CBEFEFB6CA6D32ED342903E36186154DA65A2666A43C4DC6BF51CC1A302E00FF496B461BA00DF0154B950C968CF53EFA4106E0B50CF3245
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=LEikZe,_b,_tp,byfTOb,lsjVmc,soHxf/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=n73qwf,SCuOPb,IZT63,vfuNJf,UUJqVe,ws9Tlc,siKnQd,STuCOe,njlZCf,fJpY1b,b3kMqb,EGw7Od,ZUKRxc,my67ye,t2srLd,EN3i8d,hmHrle,mWLH9d,NOeYWe,O6y8ed,fqEYIb,PrPYRd,MpJwZc,hc6Ubd,Rkm0ef,KUM7Z,oLggrd,inNHtf,L1AAkb,lwddkf,SpsfSb,fFzhe,tUnxGc,aW3pY,EFQ78c,xQtZb,I6YDgd,zbML3c,zr1jrb,vHEMJe,YHI3We,YTxL4,bSspM,Uas9Hd,zy0vNb,K0PMbc,AvtSve,qmdT9,xBaz7b,eVCnO,LDQI"
                                                                                                                                                                    Preview:"use strict";_F_installCss(".O0WRkf{-webkit-user-select:none;transition:background .2s .1s;border:0;border-radius:3px;cursor:pointer;display:inline-block;font-size:14px;font-weight:500;min-width:4em;outline:none;overflow:hidden;position:relative;text-align:center;text-transform:uppercase;-webkit-tap-highlight-color:transparent;z-index:0}.A9jyad{font-size:13px;line-height:16px}.zZhnYe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);background:#dfdfdf;box-shadow:0px 2px 2px 0px rgba(0,0,0,.14),0px 3px 1px -2px rgba(0,0,0,.12),0px 1px 5px 0px rgba(0,0,0,.2)}.zZhnYe.qs41qe{transition:box-shadow .28s cubic-bezier(0.4,0,0.2,1);transition:background .8s;box-shadow:0px 8px 10px 1px rgba(0,0,0,.14),0px 3px 14px 2px rgba(0,0,0,.12),0px 5px 5px -3px rgba(0,0,0,.2)}.e3Duub,.e3Duub a,.e3Duub a:hover,.e3Duub a:link,.e3Duub a:visited{background:#4285f4;color:#fff}.HQ8yf,.HQ8yf a{color:#4285f4}.UxubU,.UxubU a{color:#fff}.ZFr60d{position:absolute;top:0;right:0;bottom:0;left:0;background-color:tran

                                                                                                                                                                    Chrome Cache Entry: 884

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1210)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):78646
                                                                                                                                                                    Entropy (8bit):5.412136972940148
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:1536:w/Q5Up0BWTFRcxRpIoMwetxBJ9YDf4YRPlF/hyqqR4Qj2W:87mM1OxAx
                                                                                                                                                                    MD5:908E3A26A43D87BAC9396377A9C4B6A8
                                                                                                                                                                    SHA1:B9DDB61F1D0A4ED930881B909D3A4B01B2E62C7A
                                                                                                                                                                    SHA-256:417FD55B390293D45901B37398ACFC8C3B4FEDE6A395F541C2EE48F732990D61
                                                                                                                                                                    SHA-512:4FD58BA30456F96A8704412123BCA4C4A48E976E28BAEADED37232FA7A3C4C3FBAA6B79988DC7190D569D1B6024FB0C2F3EAD621A3E2D280C024D7EEC01011B6
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/s/desktop/a4aa4e18/jsbin/webcomponents-sd.vflset/webcomponents-sd.js
                                                                                                                                                                    Preview:(function(){/*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/.var k;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}function p(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if("number"==typeof a.length)return{next:aa(a)};throw Error(String(a)+" is not an iterable or ArrayLike");}function q(a){if(!(a instanceof Array)){a=p(a);for(var b,c=[];!(b=a.next()).done;)c.push(b.value);a=c}return a}.function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this);function r(){for(var a=Number(this),b=[],c=a;c<arguments.length;c++)b[c-a]=arguments[c];return b};/*..Copyright (c) 2016 The Polymer Project Authors. All rights reserved..This code may only be used unde

                                                                                                                                                                    Chrome Cache Entry: 885

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (1631)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):38670
                                                                                                                                                                    Entropy (8bit):5.380711749535656
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:LqHPXEe8NFLsDRpwubi6jdNUOFbBPkvYm9Xt/x4ihUkZb+qkzu8seK1:HRyiENUgkvYm9Xtp4BkHT
                                                                                                                                                                    MD5:6D2889D0B8C5F4817D4571D1FC489AE8
                                                                                                                                                                    SHA1:5051BA7A37B26A4169FEB76F078B7DB182E6EDF3
                                                                                                                                                                    SHA-256:F1C724F7FA58D9DAC65B1B24762BF0E0B1C0946E79D938672925398648BA7672
                                                                                                                                                                    SHA-512:B3CC68B18C8D044DB18EAAFB5ACEF029B90D51610D8BFF7CCF7D40684EEE42A34FBDD53EA4496502FDD613B327C99771C83AE4FBF012B77098D1000D3AEA180B
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=_b,_tp/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=byfTOb,lsjVmc,LEikZe"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.Tna=function(a){var b=0,c;for(c in a)b++;return b};_.Una=function(a){return a.Vg&&"function"==typeof a.Vg?a.Vg():_.ma(a)||"string"===typeof a?a.length:_.Tna(a)};_.lo=function(a){if(a.Mg&&"function"==typeof a.Mg)return a.Mg();if("undefined"!==typeof Map&&a instanceof Map||"undefined"!==typeof Set&&a instanceof Set)return Array.from(a.values());if("string"===typeof a)return a.split("");if(_.ma(a)){for(var b=[],c=a.length,d=0;d<c;d++)b.push(a[d]);return b}return _.yb(a)};._.Vna=function(a){if(a.Lg&&"function"==typeof a.Lg)return a.Lg();if(!a.Mg||"function"!=typeof a.Mg){if("undefined"!==typeof Map&&a instanceof Map)return Array.from(a.keys());if(!("undefined"!==typeof Set&&a instanceof Set)){if(_.ma(a)||"string"===typeof a){var b=[];a=a.length;for(var c=0;c<a;c++)b.push(c);return b}return _.zb(a)}}};.var Wna,Zna,Yna,Xna,Bo,Do,koa,boa,doa,coa,goa,eoa;Wna=function(a,b,c){if(b)re

                                                                                                                                                                    Chrome Cache Entry: 886

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 206x366, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):12791
                                                                                                                                                                    Entropy (8bit):7.945238351986309
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:192:jHFP3J7SPXIAxCgRQYjsOyhUKe6m0BgwtNhH14GMWdGDfe79POb+g9nd9Ojf+:bBkPYAYsPGGhXuggNX5HdGDfe8KC
                                                                                                                                                                    MD5:1EDAC276FCF2C3399D4CE33903A64D8B
                                                                                                                                                                    SHA1:C3231CE8641A31CF10FD25B61954DC1183EA6E7B
                                                                                                                                                                    SHA-256:F007462D6240F3DAD98D22D619C36625EC34A0061F094B001CBB0DAE449AAB2B
                                                                                                                                                                    SHA-512:490A97CD03A88476E5E3493D08F8F4E1C94C8B993795315AE0923A3F1C13DF99B0F4F644799E9E4CBB43C03B94FE836DE76E5F95F000DD4D5F2F1C51FF7C6B61
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/426316837_732291052209134_7394957370552107887_n.jpg?stp=dst-jpg_p206x206&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=nS2qoJSFutIAX_kDVPC&_nc_ht=scontent-atl3-2.xx&oh=00_AfDp_M8YbK99W_QPM8VqkVflybWUuVsnVSnqpwe5cb98IA&oe=65CFCE7A
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a7001000087060000ab0d0000d70f0000701100009c1600008a1e0000a51f0000f3210000b4230000f7310000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......n....".................................................................................+.2..X-..'.J.x.&..X.`q.-kU.+5......e..#0..N.#...BCH.dT...i[>.`!.N....Y.h75..Z]...-..@g.he$...V.+,.....g.\d.x&)V.:D..r.f.<.:/a.i.,.J.]...+......2.....aVp4..^f+2..r...j....lU.S.SLsk.B..El.*0..$F.6....Q...1p...'..@.Q]..:..;.Z....i.V9.~3..SH.u.,..4...'.V....N.....:6#G]A..N..u\...|...N...B_H.~S7.....7..3....c.M|e....p.u..../...A\...Z/..|.1.O..3_.....g......(..dPV.+.....1o.1.....P|........@>.E&...k.O[^f.Z.i.v1..O[.../*19.a..[......X/}l..D.........=$..gl:..O....J.t.{.n.;f....1!.G)5]d.p.^.Z.n.=....x.G..0\|..N.\....'K.oOx.|.....G..W...h.c4W....R..%.a..r....K<.{...._vy......w0..F...U

                                                                                                                                                                    Chrome Cache Entry: 887

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:RIFF (little-endian) data, Web/P image, VP8 encoding, 720x404, Scaling: [none]x[none], YUV color, decoders should clamp
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):71628
                                                                                                                                                                    Entropy (8bit):7.996867904941291
                                                                                                                                                                    Encrypted:true
                                                                                                                                                                    SSDEEP:1536:bBIhezw3i8KwXGtaUvlv3h6mXeQsQCY0gMj20pFLakLALLcgQgQ6x/o:IewdKMWvx3h6YeQjC5jfLLakngbQV
                                                                                                                                                                    MD5:D8692A10C3A091651049CAB4B997D335
                                                                                                                                                                    SHA1:A9D4105DD7F428FC10F7FF15B9F299291B111BD3
                                                                                                                                                                    SHA-256:6FE40E9405127F9088ECF46BCCAF0643450AC2160C7BB949D217393F9881E388
                                                                                                                                                                    SHA-512:26A67D86BD9E9FF93467B8E167985096BDE0F7FA0C6625E3D2CA4D5E25E27C20837B57DA4F9706183A1830946CEE0B6E7D2146D0059C71F1824D597F6CBD4506
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://i.ytimg.com/vi/YdKl9YppXeY/hq720.jpg?sqp=-oaymwEcCNAFEJQDSFXyq4qpAw4IARUAAIhCGAFwAcABBg==&rs=AOn4CLDDdILIHVCp_rfM_pZJ9rkp9NwSxQ
                                                                                                                                                                    Preview:RIFF....WEBPVP8 .........*....>Q".D..!"....p..M..wG2..t.%y@...K]..I.Tbc.E...Z>.S..W.?.....:+.9T..N.q...~].Y........o.......q....y...o.?...?......W......?........S.?..._.....{...~...7.........].....3...3.O............W...........~..?......a.......w......},.W.m...O./..C?......K.....W......\../.?..+.....'..].......`.....?.../.N.......k~........_._p...7...S......2.....M.....o........a.5._."?............z.._..?......g.....?...O.?\.%.7.#..........p.).O......s...].....?..........9.....o............'....?......c.._.....E.O.g......?......K...O...>............k..............F.U...[^L.Gv0YW4p....8......P...p...~zP.,.....)...a.r.p\..D.....n.-...7.p..a.x..G&..s-.&v..Z.!Qr.....4.%...W+,|'yV..L..,....X......b...4^.a.cF..+z.F.ZU8...CGt.Ed.c~....t6s..q.P.i...*"......j.A}x.Y.@S.VY@.<v...J.Q.[..*Sk.:.!4...yY..y.cs.=5...F....pz..P....p%.b..w..y...~D|.r..Eh#.....5...N..=2.DY/.......Q1.....5..0{...N..p..t.&.-ry..,+....7..e.+{.'.1.9......,G".6......\2..M......SF..(.....*.

                                                                                                                                                                    Chrome Cache Entry: 888

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 640x360, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):42248
                                                                                                                                                                    Entropy (8bit):7.976554473988622
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:JkkvW/zyP/kZHusFjEV7OvorF+uTQfZNMuyRE6fDgB78gctTGTFg0:JkMiyPFkgU56ffDy8gct6TFn
                                                                                                                                                                    MD5:CCD6D6E4929E48B9C184AF582D5AC38A
                                                                                                                                                                    SHA1:247B7C1772F749340AEB93D012D057EF48C1A60A
                                                                                                                                                                    SHA-256:9DAD6899F1D415BCC92073E30D3E8CE15E9D8BD6B9FBD98E6AFB74AB991CD6A1
                                                                                                                                                                    SHA-512:F30633080FC851600A591C561A987DBA6FAD543799A27A5F62DDCAF534B385570EDA49BA13CA7AAABE509BA83E4A0117F58703522768D1712E6E08B1D0792BB3
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/425769497_782305820416607_2433544004379087122_n.jpg?stp=dst-jpg_s640x640&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=j0AhL2_sCF0AX-KlB5J&_nc_ht=scontent-atl3-2.xx&oh=00_AfAZlo7zqWxDUBA272dpnj_ajkwC0D3QxtRf9BqnmrWjdQ&oe=65CFA5CC
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a700100008610000006270000bc2c00009f30000042410000dd610000c5640000d4690000736e000008a50000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......h...."...............................................................................h.\.........1I5.......\[z.BY(-l.y1.n.y.h.5.}../[........U.H.5..`...j.Q..5p.S.].....h.Ic...C..dm.%..9.J..M.._p.s....{V33-h...h.<.i......-..g9.U.P.v.[.U\T..@I.L..Z.[...4...i..5qgW.-..& .)..e{..........o.c59Y..y7.PH.}m%...z.....D.6.. .EZrJ.....H.z3.~...n.TuN.f{W3G......C1.xNf5E..Tj..cV-..BB0"..<.tq.c.F.2.p.@q.0p....O...P.=..H.>.0..D.JT.*=...R.,.b..(...S..i....9.Z.WN.ymvmSo....C..dx."..SS...l....O.l^.r.....Z|.7...M...9Z<..l<.C}#1...X.~^..Pl.D.....U......c^.@.......!9...`....G.n...[.L."..,..vYHw.D9V)o0.u....5%.1Z....W].{..T.k....k)u..X....MJ.....b]...U%.u,..d....Q";.$r`....].l...B.

                                                                                                                                                                    Chrome Cache Entry: 889

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 50x50, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1851
                                                                                                                                                                    Entropy (8bit):7.2017201771515635
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:gqpMWc1sp3txkIZ4rwMPrsHxH1jPEQiTqRnUeIsLhaklxDNMCjLzB7Jl3oDQEX:gsJiW3txkfwUA1pkTqBZz9akj7zBYDQ0
                                                                                                                                                                    MD5:3D1B719064FD10DE8C92623D479BDBD6
                                                                                                                                                                    SHA1:05809BA42C0D0831B7662B92D59A800DAE145122
                                                                                                                                                                    SHA-256:876DB5783D591A4D5D8146CFAF378450E0DB1B0EACBB127B312A678E4A90653C
                                                                                                                                                                    SHA-512:0DEE242BD009467200DAA1A5F7D7C5176E1EF1BF63BCA85AB57F5B8121EE2A5E53E371147A2D092AA816D412234AE087D2BCF4AD02ABB19E94BD8C542B408434
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t39.30808-1/426741637_7094242560631232_158916521862983305_n.jpg?stp=cp0_dst-jpg_p50x50&_nc_cat=1&ccb=1-7&_nc_sid=11e7ab&_nc_ohc=G6lzC8Efu7AAX92TQ6y&_nc_ht=scontent-atl3-2.xx&oh=00_AfBTMJTrXc2wPxBMoIzQ723Bu7CW7S35zIgQQAA2tZdwWw&oe=65CEA099
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a6d010000e001000081020000d302000027030000f6030000d80400001605000072050000cc0500003b070000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((......2.2.."...........................................................................z...f..i[G .4..... ...,.fL4..a..$.7.%.6..c>\..3...h.-Pu3 t....#..........................!"1423B................BX.9.:.%U.iL..ry8......<...4..;.2.=.@...g.]K,h..pV.....Bx..#.e.|oB...Ge/;......=Y.b.B.K.Pw..........M1..N.....!........................!"A.2Ba........?.s.ExXSi.j1,..<:.&.....n.:.....oe....".....................!....A"2BQa........?..c.....(Y6...J............z0.r...(......................!1."A.Qq.Ra#r...........?.:.....*[.{...>s....!..i.` ...7]-7Ii..*l@.]Cr.........9[LG..d';Fw..x@Z......D.Dei..9...t..FeV/...M.5..O2.I;H...=..9.M..Qi3**L......A3*.+.R%...c....S...h....#u..."..................

                                                                                                                                                                    Chrome Cache Entry: 890

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (2360)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):219843
                                                                                                                                                                    Entropy (8bit):5.458189620633946
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:3072:xcQpl8zof/VUWU/FB6F8Dra3mgfWBncuKF/PJBJjVI:xcQpWzo/VAtUKgfWm/xBJZI
                                                                                                                                                                    MD5:873E4CD8E161547488003EC1710CAF04
                                                                                                                                                                    SHA1:AEE1958724CD063287F0C38AA1AB3B6ECB32E579
                                                                                                                                                                    SHA-256:8F186B857AA3360F6A3B11444F4B5E464830E50F7C8F58317E8D8737A75FD469
                                                                                                                                                                    SHA-512:2CE9E8FB6D927C65C0200784392DF892E49AFCB6A442DB5048D96A13BB60179C3724204A631574E1C6B599B9E899178E5FD6D038A59C9CE8AE42654140D877E4
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/am=P8AmLccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/excm=_b,_tp,identifierview/ed=1/dg=0/wt=2/ujg=1/rs=AOaEmlFOTgtEHqNaKOcAPCH--APSgQWmeA/m=_b,_tp"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a||[]};(0,_._F_toggles_initialize)([0x2d26c03f, 0x800b1c, 0x3e69cb33, 0x21c9c67b, 0x1, 0x0, 0x200d6000, 0x1d, ]);./*.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0.*/./*.. SPDX-License-Identifier: Apache-2.0.*/./*.. Copyright 2013 Google LLC.. SPDX-License-Identifier: Apache-2.0.*/.var baa,daa,Sa,haa,$a,bb,cb,db,eb,iaa,fb,lb,jaa,kaa,pb,naa,paa,Fb,qaa,taa,vaa,Qb,zaa,Ub,Aaa,Baa,$b,Faa,Kaa,Laa,oc,Maa,Qaa,Raa,Taa,Uaa,Vaa,Waa,Wc,Zaa,Yaa,aba,dd,cd,bba,fd,dba,id,nd,eba,fba,yd,xd,gd,Ud,lba,Vd,oba,qba,nba,pba,Wd,Nd,rba,Xd,$d,sba,uba,vba,Od,ve,xe,Fe,Iba,Se,Ue,Ve,Ye,Lba,Nba,Pba,Qba,Rba,Sba,Vba,Xba,Zba,$ba,cca,mca,ica,oca,qca,rca,sca,tca,wca,yca,Bca,Cca,Dca,Eca,Fca,$f,Ica,Kca,Nca,Oca,aaa,Pca,tg,Qca,vg,Rca,Sca,xg,Uca,zg,ada,eda,dda,

                                                                                                                                                                    Chrome Cache Entry: 891

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (663)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):3238
                                                                                                                                                                    Entropy (8bit):5.430358322799373
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:o7FCVmOGkPvrDDzY/HwdNQ8jsu8x0fjYpId6Xt63US1+xdl59rw:osVMsriQdODWgIdatKUhw
                                                                                                                                                                    MD5:A9A9D3B9EE6F73FFCCF8140781E3CC78
                                                                                                                                                                    SHA1:0F5F34F5908BBB504729414E1301BBE047BB4FC4
                                                                                                                                                                    SHA-256:13FDE2D88756D918A795D1CD2A2B0B67C375003B2B6FF37794B60EFEE3242AA1
                                                                                                                                                                    SHA-512:FB22FE047A21C67D1034335F7289EE009562E15713573B0E676E20C267F9AE94B804664CB9DF6523A259E179ADA5F451745ECDC24EF042F30021B2B749D5821D
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:"https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en_US.pUQU5bO12yA.es5.O/ck=boq-identity.AccountsSignInUi.-i28YIXT7-o.L.B1.O/am=P8AmDccCIDCznObvGSeHAQAAAAAAAAAA1gB2/d=1/exm=AvtSve,Ctsu,EFQ78c,EGw7Od,EN3i8d,I6YDgd,IZ1fbc,IZT63,K0PMbc,KUM7Z,L1AAkb,LDQI,LEikZe,MpJwZc,NOeYWe,O6y8ed,PHUIyb,PrPYRd,Rkm0ef,RqjULd,Rusgnf,SCuOPb,STuCOe,SpsfSb,UPKV3d,UUJqVe,Uas9Hd,W2YXuc,YHI3We,YTxL4,ZUKRxc,_b,_tp,aW3pY,b3kMqb,bPkrc,bSspM,bTi8wc,byfTOb,eVCnO,fFzhe,fJpY1b,fqEYIb,hc6Ubd,hmHrle,inNHtf,kSPLL,lsjVmc,ltDFwf,lwddkf,mWLH9d,my67ye,n73qwf,njlZCf,oLggrd,pxq3x,qPfo0c,qmdT9,siKnQd,soHxf,t2srLd,tUnxGc,vHEMJe,vfuNJf,ws9Tlc,xBaz7b,xQtZb,yRXbo,ywOR5c,zbML3c,zr1jrb,zy0vNb/excm=_b,_tp,identifierview/ed=1/wt=2/ujg=1/rs=AOaEmlEMgV3zx9hm5OxjeE6T1ZLRXdfXAA/ee=ASJRFf:LANRae;Al0B8:kibjWe;DaIJ8c:iAskyc;EVNhjf:pw70Gc;EkYFhd:BDnJmb;EmZ2Bf:zr1jrb;Erl4fe:FloWmf;JsbNhc:Xd8iUd;LBgRLc:XVMNvd;Me32dd:MEeYgc;NPKaK:PVlQOd;NSEoX:lazG7b;Oj465e:KG2eXe;Pjplud:EEDORb;QGR0gd:Mlhmy;SMDL4c:K0PMbc;SNUn3:ZwDk9d;UpnZUd:nnwwYc;XdiAjb:NLiXbe;a56pNe:JEfCwb;cEt90b:ws9Tlc;dIoSBb:SpsfSb;eBAeSb:zbML3c;iFQyKf:vfuNJf;io8t5d:yDVVkb;kMFpHd:OTA3Ae;nAFL3:NTMZac;nTuGK:JKNPM;oGtAuc:sOXFj;oSUNyd:K0PMbc;oXZmbc:tUnxGc;pXdRYb:fqEYIb;qddgKe:xQtZb;sP4Vbe:VwDzFe;uY49fb:COQbmf;ul9GGd:VDovNc;vNjB7d:YTxL4;wR5FRb:siKnQd;yxTchf:KUM7Z/m=ZwDk9d,RMhBfe"
                                                                                                                                                                    Preview:"use strict";this.default_AccountsSignInUi=this.default_AccountsSignInUi||{};(function(_){var window=this;.try{._.k("ZwDk9d");.var Gw=function(a){_.I.call(this,a.Ha)};_.A(Gw,_.I);Gw.Oa=_.I.Oa;Gw.Ba=_.I.Ba;Gw.prototype.rM=function(a){return _.gf(this,{Xa:{DN:_.vk}}).then(function(b){var c=window._wjdd,d=window._wjdc;return!c&&d?new _.qi(function(e){window._wjdc=function(f){d(f);e(PCa(f,b,a))}}):PCa(c,b,a)})};var PCa=function(a,b,c){return(a=a&&a[c])?a:b.Xa.DN.rM(c)};.Gw.prototype.aa=function(a,b){var c=_.Dra(b).Xg;if(c.startsWith("$")){var d=_.Vm.get(a);_.Jq[b]&&(d||(d={},_.Vm.set(a,d)),d[c]=_.Jq[b],delete _.Jq[b],_.Kq--);if(d)if(a=d[c])b=_.ff(a);else throw Error("Jb`"+b);else b=null}else b=null;return b};_.yr(_.Lca,Gw);._.l();._.k("SNUn3");._.OCa=new _.gl(_.og);._.l();._.k("RMhBfe");.var QCa=function(a,b){a=_.Ypa(a,b);return 0==a.length?null:a[0].tb},RCa=function(){return Object.values(_.Gp).reduce(function(a,b){return a+Object.keys(b).length},0)},SCa=function(){return Object.entries(_

                                                                                                                                                                    Chrome Cache Entry: 892

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JSON data
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):1586
                                                                                                                                                                    Entropy (8bit):4.971538502379734
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:24:Yj0jutsEgaFs9v8eY2x2UfwhUdt0A66ucXaKUoXab/:Y9ts3aFs90pUbtd79aKpab/
                                                                                                                                                                    MD5:052B9F6B80876F7C32894105E377BA3B
                                                                                                                                                                    SHA1:2018FC66AB3C28A18167B11C547406CF1BBAF89A
                                                                                                                                                                    SHA-256:A7B005C03E9F79AB0D36080925C50F6C101BBBF9853DD849E9A0030A810C89A1
                                                                                                                                                                    SHA-512:2DC6CA28250F1E5A0EF91D677A6732BD64D5D09C930B78AF226823621C0F1A6BDBDE23583C75F69D5101E918D7FAF40ADD7C236B0AA733D3B02F95528D1B3374
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://www.youtube.com/manifest.webmanifest
                                                                                                                                                                    Preview:{"name":"YouTube","short_name":"YouTube","background_color":"#FFFFFF","display":"minimal-ui","start_url":"/?feature\u003dytca","scope":"/","icons":[{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_144x144.png","sizes":"144x144","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/branding/favicon/favicon_192x192.png","sizes":"192x192","type":"image/png"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_16x16.png","sizes":"16x16","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_32x32.png","sizes":"32x32","type":"image/png","purpose":"monochrome"},{"src":"https://fonts.gstatic.com/s/i/googlematerialicons/video_youtube/v11/white-48dp/1x/gm_video_youtube_white_48dp.png","sizes":"48x48","type":"image/png","purpose":"monochrome"},{"src":"https://www.gstatic.com/youtube/img/web/monochrome/logo_512x512.png","sizes":"512x512","type":"image/png","purpose":"monochrome"}],"theme_color":"#FF0000"

                                                                                                                                                                    Chrome Cache Entry: 893

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x960, components 3
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):28467
                                                                                                                                                                    Entropy (8bit):7.851752194848128
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:768:ZpJpuhCHlCi5DWl0G98jAlAhqH1sZs6XPLpS0:ZzchCHl5PGyjAlSs6fp
                                                                                                                                                                    MD5:564F47EAF8BAEA76E4F305B905CF703F
                                                                                                                                                                    SHA1:63588ED42B6C27E891F1F962A455538F9D8CE825
                                                                                                                                                                    SHA-256:001B89A0F7FA104A2FDCAC23249B9AD3A336BDA418B758D356EAD6352FB90E89
                                                                                                                                                                    SHA-512:0C88651C5B3558045EEAAC83830E481411BD37D3AC34E9AE7C24D63EC2230E8BDC787EE4B99AA51AE1C8ECF72687C5ED2470ACF1D5B96207AFF4B8F3E8CD8616
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://scontent-atl3-2.xx.fbcdn.net/v/t15.5256-10/423527174_1070518244243264_5806486911836899352_n.jpg?stp=dst-jpg_s960x960&_nc_cat=1&ccb=1-7&_nc_sid=1a7029&_nc_ohc=sGOzMD4buOsAX99-VGl&_nc_ht=scontent-atl3-2.xx&oh=00_AfC9BLNHzTblRWmZGqsNtknMBX3PYnTlSZNMYrWP9CxIHQ&oe=65CE7198
                                                                                                                                                                    Preview:......JFIF..............Photoshop 3.0.8BIM.......h..(.bFBMD0a000a70010000de100000db20000003220000792300000233000002460000474c00004c4e000042500000336f0000....C.....................................%...#... , #&')*)..-0-(0%()(...C...........(...((((((((((((((((((((((((((((((((((((((((((((((((((..........."...................................................................................................................................................................................................................................................................................................................................................................................................................................z..OS..J`.H...O..../.|.<.W.v.Y...?.....OL......~e..m...................\.o.....p..-........X9............G..N..T......._C.N.....wk..`u.7.S..................W..,=s.....k..y....t.I..~..s.f...}N.9...u..u...........N_....i..............................................

                                                                                                                                                                    Chrome Cache Entry: 894

                                                                                                                                                                    Download File
                                                                                                                                                                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    File Type:ASCII text, with very long lines (710)
                                                                                                                                                                    Category:downloaded
                                                                                                                                                                    Size (bytes):3941
                                                                                                                                                                    Entropy (8bit):5.104648065894702
                                                                                                                                                                    Encrypted:false
                                                                                                                                                                    SSDEEP:48:KjR0kZK7R0kFrVkzzQxPYqX9q2lqAEY8HIXOYlPMLycA1:amRqb7N4sq
                                                                                                                                                                    MD5:B3B9CF23AA265B8F37D4691C40E8FC1E
                                                                                                                                                                    SHA1:8E89853722602A5A757D02CB526F1213FBF3F4B9
                                                                                                                                                                    SHA-256:7F04A52CAC7B3CEF13108017404425598FB2A95C8258B750669AF9A3489D473D
                                                                                                                                                                    SHA-512:75B38C137570535F2706004BCAE3DC9EB5756123B29795F71AD44D976A4DAB533478EA2D60B77B0B398D891DC6BE85186E9FB036F657185AF15267C5188357EC
                                                                                                                                                                    Malicious:false
                                                                                                                                                                    URL:https://static.xx.fbcdn.net/rsrc.php/v3/yE/r/OYCtr0a6ZH6.js?_nc_x=Ij3Wp8lg5Kz
                                                                                                                                                                    Preview:;/*FB_PKG_DELIM*/..__d("CometVideoHomeCatalogRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7144556005623088"}),null);.__d("CometVideoHomeCatalogRootQuery$Parameters",["CometVideoHomeCatalogRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometVideoHomeCatalogRootQuery_facebookRelayOperation"),metadata:{},name:"CometVideoHomeCatalogRootQuery",operationKind:"query",text:null,providedVariables:{__relay_internal__pv__StoriesRingrelayprovider:b("StoriesRing.relayprovider")}}};e.exports=a}),null);.__d("CometVideoHomeLiveRootQuery_facebookRelayOperation",[],(function(a,b,c,d,e,f){e.exports="7318308474858884"}),null);.__d("CometVideoHomeLiveRootQuery$Parameters",["CometVideoHomeLiveRootQuery_facebookRelayOperation","StoriesRing.relayprovider"],(function(a,b,c,d,e,f){"use strict";a={kind:"PreloadableConcreteRequest",params:{id:b("CometVideoHomeLiveRootQuery_facebookRelay

                                                                                                                                                                    Static File Info

                                                                                                                                                                    General

                                                                                                                                                                    File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                    Entropy (8bit):7.932723171864367
                                                                                                                                                                    TrID:
                                                                                                                                                                    • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                    • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                    • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                    File name:SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    File size:2'399'232 bytes
                                                                                                                                                                    MD5:11a2a91d1b8c9b3b0784d70a78f2da6f
                                                                                                                                                                    SHA1:5ecb42524c51dea5e2377419f77c25ed8fedf0b2
                                                                                                                                                                    SHA256:a57a3b08bfb8aec37a412a829baf276ce0dd2782927ccc925f4509c97680ea73
                                                                                                                                                                    SHA512:5d29bca16e2733dea93d571783561cbcf229c908d104eeb3f2080d59141f945534e76a9c4ee4046d91dc62f68e47902625f4215ea782f4bd9d4b0e41b7177e78
                                                                                                                                                                    SSDEEP:49152:AtNjudw+TeIsz5y48CU+1VvWlLt0YiO7N+9k/tm5lxMTGiR9X:XCTy48CU+1VIJ0XO8uVm5/uGiH
                                                                                                                                                                    TLSH:C6B523CF3C004157DA843B7045D1FB78022FECA9A69A50DAACDA7B97B533E161D2386D
                                                                                                                                                                    File Content Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......C...............L.......L.......L.......H.G.....H.......H.......H...R...L.......L.......L.........................E.......-....

                                                                                                                                                                    File Icon

                                                                                                                                                                    Icon Hash:7192ecece8b2924d

                                                                                                                                                                    Static PE Info

                                                                                                                                                                    General

                                                                                                                                                                    Entrypoint:0x9c4000
                                                                                                                                                                    Entrypoint Section:.taggant
                                                                                                                                                                    Digitally signed:false
                                                                                                                                                                    Imagebase:0x400000
                                                                                                                                                                    Subsystem:windows gui
                                                                                                                                                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                    DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                                                                                                                    Time Stamp:0x65C5D990 [Fri Feb 9 07:51:44 2024 UTC]
                                                                                                                                                                    TLS Callbacks:
                                                                                                                                                                    CLR (.Net) Version:
                                                                                                                                                                    OS Version Major:6
                                                                                                                                                                    OS Version Minor:0
                                                                                                                                                                    File Version Major:6
                                                                                                                                                                    File Version Minor:0
                                                                                                                                                                    Subsystem Version Major:6
                                                                                                                                                                    Subsystem Version Minor:0
                                                                                                                                                                    Import Hash:2eabe9054cad5152567f0699947a2c5b

                                                                                                                                                                    Entrypoint Preview

                                                                                                                                                                    Instruction
                                                                                                                                                                    jmp 00007FCF9CFAFAFAh

                                                                                                                                                                    Data Directories

                                                                                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x1490540x68.idata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x1370000x110a0.rsrc
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x1491f80x8.idata
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                    Sections

                                                                                                                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                    0x10000x1360000x8ee007f8d309782d823561306736c232d6994False0.9998239966097988data7.983941674526406IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .rsrc0x1370000x110a00x200053499c5ffc61fd429c552aa9f51dea5dFalse0.982421875data7.9038550366875375IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .idata 0x1490000x10000x200588e00183b8b4dbb8c7106492f04143dFalse0.14453125data0.9824704719748909IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    0x14a0000x2c30000x20032d7ca5c2ed36ce49a94991fdfc04f73unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    zcmtppku0x40d0000x1b60000x1b540030f41c4f3dd37c90e21927f27fdf82a8False0.9605449765937679big endian ispell hash file (?),7.91533177692051IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    kmucpvwr0x5c30000x10000x4003f55af0f071958319dfbac65dec4cf35False0.8134765625data6.293430964816731IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                    .taggant0x5c40000x30000x2200d55106a9c44fb97b5ef882f9739d3fc7False0.059857536764705885DOS executable (COM)0.8087908507968429IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                                                                                                                                    Resources

                                                                                                                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                    RT_ICON0x5b13a80x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3779 x 3779 px/mRussianRussia0.10367620962971726
                                                                                                                                                                    RT_GROUP_ICON0x5c1bd00x14dataRussianRussia1.15
                                                                                                                                                                    RT_VERSION0x5c1be40x2b4dataRussianRussia0.48121387283236994
                                                                                                                                                                    RT_MANIFEST0x5c1e980x2e6XML 1.0 document, ASCII text, with CRLF line terminators0.45417789757412397
                                                                                                                                                                    RT_MANIFEST0x5c217e0x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                                                                                                                                                    Imports

                                                                                                                                                                    DLLImport
                                                                                                                                                                    kernel32.dlllstrcpy

                                                                                                                                                                    Possible Origin

                                                                                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                    RussianRussia
                                                                                                                                                                    EnglishUnited States

                                                                                                                                                                    Network Behavior

                                                                                                                                                                    ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                                                                                    Statistics

                                                                                                                                                                    CPU Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    Memory Usage

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    High Level Behavior Distribution

                                                                                                                                                                    Click to dive into process behavior distribution

                                                                                                                                                                    Behavior

                                                                                                                                                                    Click to jump to process

                                                                                                                                                                    System Behavior

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:0
                                                                                                                                                                    Start time:20:39:17
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\Users\user\Desktop\SecuriteInfo.com.Trojan.Siggen26.6766.29781.19786.exe
                                                                                                                                                                    Imagebase:0xa40000
                                                                                                                                                                    File size:2'399'232 bytes
                                                                                                                                                                    MD5 hash:11A2A91D1B8C9B3B0784D70A78F2DA6F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:2
                                                                                                                                                                    Start time:20:39:22
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                    Imagebase:0x3d0000
                                                                                                                                                                    File size:187'904 bytes
                                                                                                                                                                    MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:3
                                                                                                                                                                    Start time:20:39:22
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:4
                                                                                                                                                                    Start time:20:39:22
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                    Imagebase:0x3d0000
                                                                                                                                                                    File size:187'904 bytes
                                                                                                                                                                    MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:5
                                                                                                                                                                    Start time:20:39:22
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:6
                                                                                                                                                                    Start time:20:39:22
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    Imagebase:0x2a0000
                                                                                                                                                                    File size:2'399'232 bytes
                                                                                                                                                                    MD5 hash:11A2A91D1B8C9B3B0784D70A78F2DA6F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                    • Detection: 47%, ReversingLabs
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:7
                                                                                                                                                                    Start time:20:39:22
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\ProgramData\MPGPH131\MPGPH131.exe
                                                                                                                                                                    Imagebase:0x2a0000
                                                                                                                                                                    File size:2'399'232 bytes
                                                                                                                                                                    MD5 hash:11A2A91D1B8C9B3B0784D70A78F2DA6F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:8
                                                                                                                                                                    Start time:20:39:30
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                                                                                                                                                    Imagebase:0x8c0000
                                                                                                                                                                    File size:2'399'232 bytes
                                                                                                                                                                    MD5 hash:11A2A91D1B8C9B3B0784D70A78F2DA6F
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 47%, ReversingLabs
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:11
                                                                                                                                                                    Start time:20:39:37
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\jQVZ0AI5Ls1YopKhCBc3.exe"
                                                                                                                                                                    Imagebase:0x870000
                                                                                                                                                                    File size:917'504 bytes
                                                                                                                                                                    MD5 hash:67B659FCDDF2F8C738A12D6E482A076B
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 22%, ReversingLabs
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:12
                                                                                                                                                                    Start time:20:39:37
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.youtube.com/
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:13
                                                                                                                                                                    Start time:20:39:38
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.linkedin.com/login
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:14
                                                                                                                                                                    Start time:20:39:38
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.facebook.com/video
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:15
                                                                                                                                                                    Start time:20:39:38
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://accounts.google.com/
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:17
                                                                                                                                                                    Start time:20:39:38
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1936,i,5473178486326315563,2545621214023589303,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:18
                                                                                                                                                                    Start time:20:39:38
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1992 --field-trial-handle=1936,i,1783626661732821117,8687075592315426283,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:19
                                                                                                                                                                    Start time:20:39:39
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1976,i,6856639093823868645,7335846577343969463,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:high
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:20
                                                                                                                                                                    Start time:20:39:40
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\RageMP131\RageMP131.exe"
                                                                                                                                                                    Imagebase:0x8c0000
                                                                                                                                                                    File size:2'399'232 bytes
                                                                                                                                                                    MD5 hash:11A2A91D1B8C9B3B0784D70A78F2DA6F
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:low
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:21
                                                                                                                                                                    Start time:20:39:40
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
                                                                                                                                                                    Imagebase:0x7ff7f97c0000
                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Reputation:moderate
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:22
                                                                                                                                                                    Start time:20:39:40
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1916,i,11065865018849172942,2521104990630376558,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:23
                                                                                                                                                                    Start time:20:39:41
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
                                                                                                                                                                    Imagebase:0x7ff7f97c0000
                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:24
                                                                                                                                                                    Start time:20:39:41
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
                                                                                                                                                                    Imagebase:0x7ff7f97c0000
                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:25
                                                                                                                                                                    Start time:20:39:41
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 HR" /sc HOURLY /rl HIGHEST
                                                                                                                                                                    Imagebase:0x3d0000
                                                                                                                                                                    File size:187'904 bytes
                                                                                                                                                                    MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:26
                                                                                                                                                                    Start time:20:39:42
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1912,i,15615417388423881991,543541311184639790,262144 /prefetch:3
                                                                                                                                                                    Imagebase:0x7ff7f97c0000
                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:27
                                                                                                                                                                    Start time:20:39:42
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:28
                                                                                                                                                                    Start time:20:39:42
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:29
                                                                                                                                                                    Start time:20:39:42
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1064 --field-trial-handle=2040,i,3936048782353792184,14433501436862568511,262144 /prefetch:3
                                                                                                                                                                    Imagebase:0x7ff7f97c0000
                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:30
                                                                                                                                                                    Start time:20:39:43
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate https://www.youtube.com
                                                                                                                                                                    Imagebase:0x7ff7f97c0000
                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:31
                                                                                                                                                                    Start time:20:39:43
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:32
                                                                                                                                                                    Start time:20:39:43
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
                                                                                                                                                                    Imagebase:0x7ff678760000
                                                                                                                                                                    File size:3'242'272 bytes
                                                                                                                                                                    MD5 hash:45DE480806D1B5D462A7DDE4DCEFC4E4
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:33
                                                                                                                                                                    Start time:20:39:43
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:schtasks /create /f /RU "user" /tr "C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe" /tn "MSIUpdaterV131 LG" /sc ONLOGON /rl HIGHEST
                                                                                                                                                                    Imagebase:0x3d0000
                                                                                                                                                                    File size:187'904 bytes
                                                                                                                                                                    MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:34
                                                                                                                                                                    Start time:20:39:43
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:35
                                                                                                                                                                    Start time:20:39:44
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                    Imagebase:0x7ff6ee680000
                                                                                                                                                                    File size:862'208 bytes
                                                                                                                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:36
                                                                                                                                                                    Start time:20:39:44
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:37
                                                                                                                                                                    Start time:20:39:44
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:38
                                                                                                                                                                    Start time:20:39:45
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=2072,i,1673978244121305096,9852326822399086703,262144 /prefetch:3
                                                                                                                                                                    Imagebase:0x7ff7f97c0000
                                                                                                                                                                    File size:4'210'216 bytes
                                                                                                                                                                    MD5 hash:69222B8101B0601CC6663F8381E7E00F
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:39
                                                                                                                                                                    Start time:20:39:45
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com --attempting-deelevation
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:40
                                                                                                                                                                    Start time:20:39:45
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video --attempting-deelevation
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:41
                                                                                                                                                                    Start time:20:39:47
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:42
                                                                                                                                                                    Start time:20:39:48
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\dHERKKd2xGPyY5Ssqp_N.exe"
                                                                                                                                                                    Imagebase:0xdc0000
                                                                                                                                                                    File size:1'931'264 bytes
                                                                                                                                                                    MD5 hash:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002A.00000002.2084783663.0000000000DC1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002A.00000003.1921954403.00000000049C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:43
                                                                                                                                                                    Start time:20:39:48
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                    Imagebase:0xe0000
                                                                                                                                                                    File size:1'931'264 bytes
                                                                                                                                                                    MD5 hash:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002B.00000002.2091149221.00000000000E1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002B.00000003.2039950700.0000000004690000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:44
                                                                                                                                                                    Start time:20:39:48
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com --attempting-deelevation
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:46
                                                                                                                                                                    Start time:20:39:52
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:48
                                                                                                                                                                    Start time:20:39:54
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:C:\ProgramData\MSIUpdaterV131\MSIUpdaterV131.exe
                                                                                                                                                                    Imagebase:0xe0000
                                                                                                                                                                    File size:1'931'264 bytes
                                                                                                                                                                    MD5 hash:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Yara matches:
                                                                                                                                                                    • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000030.00000002.2160160951.00000000000E1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
                                                                                                                                                                    • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000030.00000003.2055220279.0000000004890000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:49
                                                                                                                                                                    Start time:20:39:55
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe
                                                                                                                                                                    Wow64 process (32bit):true
                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\heidi3rWvK1xaZKPt\4sPiYiirBc4Eg8wqN443.exe"
                                                                                                                                                                    Imagebase:0xe00000
                                                                                                                                                                    File size:1'755'648 bytes
                                                                                                                                                                    MD5 hash:64D74B4DCF40E24D3F163421AD180350
                                                                                                                                                                    Has elevated privileges:true
                                                                                                                                                                    Has administrator privileges:true
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:50
                                                                                                                                                                    Start time:20:39:56
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2352 -parentBuildID 20230927232528 -prefsHandle 2284 -prefMapHandle 1816 -prefsLen 25298 -prefMapSize 238442 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc5eb95e-32b5-4e67-b0fb-c26c990538d2} 3392 "\\.\pipe\gecko-crash-server-pipe.3392" 2000786cf10 socket
                                                                                                                                                                    Imagebase:0x7ff6d20e0000
                                                                                                                                                                    File size:676'768 bytes
                                                                                                                                                                    MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Has exited:false

                                                                                                                                                                    General

                                                                                                                                                                    Target ID:53
                                                                                                                                                                    Start time:20:39:59
                                                                                                                                                                    Start date:12/02/2024
                                                                                                                                                                    Path:C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe
                                                                                                                                                                    Wow64 process (32bit):false
                                                                                                                                                                    Commandline:"C:\Users\user\AppData\Local\AdobeUpdaterV131\AdobeUpdaterV131.exe"
                                                                                                                                                                    Imagebase:0xa30000
                                                                                                                                                                    File size:1'931'264 bytes
                                                                                                                                                                    MD5 hash:027F0C0AE28575127E76E80E2E91D46D
                                                                                                                                                                    Has elevated privileges:false
                                                                                                                                                                    Has administrator privileges:false
                                                                                                                                                                    Programmed in:C, C++ or other language
                                                                                                                                                                    Antivirus matches:
                                                                                                                                                                    • Detection: 100%, Avira
                                                                                                                                                                    • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                    Has exited:true

                                                                                                                                                                    Disassembly

                                                                                                                                                                    Reset < >

                                                                                                                                                                      Execution Graph

                                                                                                                                                                      Execution Coverage:17.3%
                                                                                                                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                      Signature Coverage:67.5%
                                                                                                                                                                      Total number of Nodes:2000
                                                                                                                                                                      Total number of Limit Nodes:176
                                                                                                                                                                      execution_graph 53246 a8efa0 53318 a8efc6 53246->53318 53247 a92f70 53248 a8eff1 53249 aa5a60 4 API calls 53248->53249 53250 aa5a60 4 API calls 53248->53250 53249->53248 53251 a8f035 53250->53251 53252 a8f07b 53251->53252 53254 a8f08c 53252->53254 53253 a42810 4 API calls 53253->53254 53254->53253 53255 a42810 4 API calls 53254->53255 53256 a8f10b 53255->53256 53258 a8f133 53256->53258 54132 a92af9 53256->54132 54133 a6d970 53256->54133 53262 a8f145 53258->53262 53259 aa5a60 4 API calls 53260 a92b1a 53259->53260 53261 aa5a60 4 API calls 53260->53261 53269 a92b36 53261->53269 53263 a8f161 53262->53263 53264 aa5a60 4 API calls 53263->53264 53265 a8f169 53264->53265 53266 a8f180 53265->53266 53268 a8f187 53266->53268 53267 a42810 4 API calls 53267->53269 53270 aa5a60 4 API calls 53268->53270 53269->53267 53272 a92bdc 53269->53272 53271 a8f18f 53270->53271 53274 a42700 4 API calls 53271->53274 53272->53272 53273 a42810 4 API calls 53272->53273 53275 a92c19 53273->53275 53276 a8f1c9 53274->53276 53277 a6d970 8 API calls 53275->53277 53279 aa5a60 4 API calls 53275->53279 53278 a42700 4 API calls 53276->53278 53277->53275 53280 a8f208 53278->53280 53284 a92c52 53279->53284 53281 a6d970 8 API calls 53280->53281 53283 a8f21c 53281->53283 53282 aa5a60 4 API calls 53282->53284 53286 a8f231 53283->53286 53284->53282 53285 a92c9c 53284->53285 53292 a92cb7 53285->53292 53287 a42810 4 API calls 53287->53292 53292->53287 53298 a92d3c 53292->53298 53295 a42810 4 API calls 53295->53298 53297 a6d970 8 API calls 53297->53298 53298->53295 53298->53297 53301 a92d73 53298->53301 53303 a92d8f 53301->53303 53307 aa5a60 4 API calls 53303->53307 53318->53247 53318->53248 53319 a42700 4 API calls 53318->53319 53322 a6d970 8 API calls 53318->53322 53319->53318 53322->53318 54132->53259 54134 a6d9ce __fread_nolock 54133->54134 54188 aa9870 54134->54188 54137 a6da2d 54139 aa5a60 4 API calls 54137->54139 54138 a6e6b9 54140 a42700 4 API calls 54138->54140 54144 a6da3e 54139->54144 54141 a6e6c9 54140->54141 54218 aa4700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54141->54218 54143 a6e6df 54145 a42660 3 API calls 54143->54145 54147 a6da5c 54144->54147 54185 a6da7c std::_Locinfo::_Locinfo_ctor 54144->54185 54146 a6e6b7 54145->54146 54151 a42700 4 API calls 54146->54151 54187 a6e744 std::_Locinfo::_Locinfo_ctor 54146->54187 54148 aa7c60 5 API calls 54147->54148 54150 a6da61 54148->54150 54149 a6e6ab 54152 aa7c60 5 API calls 54149->54152 54154 aa7c60 5 API calls 54150->54154 54155 a6e71f 54151->54155 54152->54146 54153 a6f6f0 54157 a6da6c 54154->54157 54212 a42660 54157->54212 54162 a6f846 54220 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54162->54220 54163 b21e70 3 API calls 54167 a6f850 54163->54167 54164 a6f829 54164->53256 54165 a6da77 54165->54163 54165->54164 54169 aab810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54169->54187 54170 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54170->54185 54171 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54171->54187 54172 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54172->54185 54174 aad230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54174->54187 54176 aa57e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54176->54185 54177 aab810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54177->54185 54178 a4beb0 7 API calls 54178->54187 54179 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54179->54187 54180 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 54180->54185 54181 ab1d40 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54181->54187 54183 a6f860 ExitProcess RtlAllocateHeap RtlFreeHeap 54183->54187 54184 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54184->54185 54185->54149 54185->54162 54185->54165 54185->54170 54185->54172 54185->54176 54185->54177 54185->54180 54185->54184 54186 a4beb0 7 API calls 54185->54186 54196 aa97b0 54185->54196 54204 aa99d0 54185->54204 54217 ab26f0 4 API calls 3 library calls 54185->54217 54186->54185 54187->54153 54187->54162 54187->54165 54187->54169 54187->54171 54187->54174 54187->54178 54187->54179 54187->54181 54187->54183 54207 aa5770 54187->54207 54189 aa9885 54188->54189 54189->54189 54190 aa98bf 54189->54190 54192 aa989f 54189->54192 54221 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54190->54221 54193 aad420 4 API calls 54192->54193 54195 a6da05 54193->54195 54195->54137 54195->54138 54197 aa97d0 54196->54197 54197->54197 54198 aa9806 54197->54198 54199 aa97e5 54197->54199 54222 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54198->54222 54201 aad420 4 API calls 54199->54201 54203 aa97fe 54201->54203 54203->54185 54205 aa57e0 4 API calls 54204->54205 54206 aa99e6 54205->54206 54206->54185 54217->54185 54218->54143 57139 a97f20 57140 a97f71 57139->57140 57140->57140 57141 a97ff8 57140->57141 57142 a9a0d7 57140->57142 57143 aad420 4 API calls 57141->57143 57503 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57142->57503 57145 a98021 57143->57145 57147 b1bed2 GetSystemTimePreciseAsFileTime 57145->57147 57146 a9a0dc 57504 b1bb7b 8 API calls std::locale::_Setgloballocale 57146->57504 57149 a9804e 57147->57149 57149->57146 57151 a98059 57149->57151 57150 a9a0e2 57505 b1bb7b 8 API calls std::locale::_Setgloballocale 57150->57505 57153 a98079 __Mtx_unlock 57151->57153 57159 a9806d GetFileAttributesA 57151->57159 57157 b1bed2 GetSystemTimePreciseAsFileTime 57153->57157 57166 a98093 __Mtx_unlock 57153->57166 57154 a9a0e8 57506 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57154->57506 57156 a9a0ed 57507 b1bb7b 8 API calls std::locale::_Setgloballocale 57156->57507 57160 a980cd 57157->57160 57159->57153 57159->57166 57160->57150 57162 a980d8 CreateDirectoryA 57160->57162 57161 a9a0f3 57508 b1bb7b 8 API calls std::locale::_Setgloballocale 57161->57508 57162->57166 57164 a9a0f9 57509 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57164->57509 57171 b1c950 std::_Facet_Register 4 API calls 57166->57171 57177 a98f43 57166->57177 57192 a98f1b 57166->57192 57167 a9a0fe 57510 b1bb7b 8 API calls std::locale::_Setgloballocale 57167->57510 57169 a9a104 57511 b1bb7b 8 API calls std::locale::_Setgloballocale 57169->57511 57170 a4c000 13 API calls 57170->57177 57173 a9814e 57171->57173 57453 ab97b0 57173->57453 57174 a9a10a 57512 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57174->57512 57179 a98fd8 57177->57179 57180 a9a123 57177->57180 57178 a9a10f 57513 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57178->57513 57183 aad420 4 API calls 57179->57183 57514 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57180->57514 57189 a98ffe 57183->57189 57184 a98efd 57188 aaba40 3 API calls 57184->57188 57185 a9a114 57186 b21e70 3 API calls 57185->57186 57190 a9a119 57186->57190 57187 a9a128 57515 b1bb7b 8 API calls std::locale::_Setgloballocale 57187->57515 57188->57192 57193 b1bed2 GetSystemTimePreciseAsFileTime 57189->57193 57194 b21e70 3 API calls 57190->57194 57192->57170 57192->57177 57196 a9902c 57193->57196 57197 a9a11e 57194->57197 57195 a9a12e 57516 b1bb7b 8 API calls std::locale::_Setgloballocale 57195->57516 57196->57187 57199 a99037 57196->57199 57200 b21e70 3 API calls 57197->57200 57202 a99057 __Mtx_unlock 57199->57202 57205 a9904b GetFileAttributesA 57199->57205 57200->57180 57201 a9a134 57517 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57201->57517 57207 b1bed2 GetSystemTimePreciseAsFileTime 57202->57207 57217 a99071 __Mtx_unlock 57202->57217 57204 a9a139 57518 b1bb7b 8 API calls std::locale::_Setgloballocale 57204->57518 57205->57202 57205->57217 57208 a990ac 57207->57208 57208->57195 57212 a990b7 CreateDirectoryA 57208->57212 57209 aa26a0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57335 a98177 __Mtx_unlock 57209->57335 57210 a9a13f 57519 b1bb7b 8 API calls std::locale::_Setgloballocale 57210->57519 57212->57217 57213 a9a145 57520 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57213->57520 57215 aa27b0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57215->57335 57216 a9a14a 57521 b1bb7b 8 API calls std::locale::_Setgloballocale 57216->57521 57223 a99f0b 57217->57223 57226 b1c950 std::_Facet_Register 4 API calls 57217->57226 57240 a99ee0 57217->57240 57218 b1c950 std::_Facet_Register 4 API calls 57218->57335 57220 a99f93 57221 a9a150 57522 b1bb7b 8 API calls std::locale::_Setgloballocale 57221->57522 57222 a4c000 13 API calls 57222->57223 57223->57220 57227 b21e70 3 API calls 57223->57227 57224 ab97b0 4 API calls 57224->57335 57229 a99133 57226->57229 57238 a9a174 57227->57238 57228 a9a156 57523 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57228->57523 57231 ab97b0 4 API calls 57229->57231 57366 a99163 __Mtx_unlock 57231->57366 57232 a9a15b 57524 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57232->57524 57235 a99ec5 57237 aaba40 3 API calls 57235->57237 57236 a9a160 57239 b21e70 3 API calls 57236->57239 57237->57240 57243 aa97b0 4 API calls 57238->57243 57248 a9aff4 57238->57248 57242 a9a165 57239->57242 57240->57222 57240->57223 57241 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57241->57335 57244 b21e70 3 API calls 57242->57244 57245 a9a244 57243->57245 57246 a9a16a 57244->57246 57249 a4bf40 10 API calls 57245->57249 57247 b21e70 3 API calls 57246->57247 57247->57223 57250 a9b0e8 57248->57250 57251 a9cc26 57248->57251 57294 a9cac5 57248->57294 57252 aad420 4 API calls 57250->57252 57546 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57251->57546 57256 aa26a0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57256->57366 57263 aa57e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57263->57335 57271 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57271->57335 57274 b1c950 std::_Facet_Register 4 API calls 57274->57366 57275 b1bed2 GetSystemTimePreciseAsFileTime 57275->57335 57280 b21e70 3 API calls 57283 ab97b0 4 API calls 57283->57366 57289 b22a20 3 API calls 57289->57335 57290 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57290->57335 57294->57280 57301 a9caf8 57294->57301 57296 aaba40 3 API calls 57296->57366 57302 aad230 4 API calls 57302->57335 57311 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57311->57366 57315 b262a8 7 API calls 57315->57335 57319 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57319->57366 57322 b22a20 3 API calls 57322->57366 57323 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57323->57335 57325 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57325->57366 57326 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57326->57335 57328 a42be0 6 API calls 57328->57335 57329 aad230 4 API calls 57329->57366 57334 b1bed2 GetSystemTimePreciseAsFileTime 57334->57366 57335->57154 57335->57156 57335->57161 57335->57164 57335->57167 57335->57169 57335->57174 57335->57178 57335->57184 57335->57185 57335->57190 57335->57197 57335->57209 57335->57215 57335->57218 57335->57224 57335->57241 57335->57263 57335->57271 57335->57275 57335->57289 57335->57290 57335->57302 57335->57315 57335->57323 57335->57326 57335->57328 57498 aaba40 57335->57498 57338 aa57e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57338->57366 57345 aa27b0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57345->57366 57346 b262a8 7 API calls 57346->57366 57353 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57353->57366 57362 a42be0 6 API calls 57362->57366 57365 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57365->57366 57366->57201 57366->57204 57366->57210 57366->57213 57366->57216 57366->57221 57366->57228 57366->57232 57366->57235 57366->57236 57366->57242 57366->57246 57366->57256 57366->57274 57366->57283 57366->57296 57366->57311 57366->57319 57366->57322 57366->57325 57366->57329 57366->57334 57366->57338 57366->57345 57366->57346 57366->57353 57366->57362 57366->57365 57454 ab97ef 57453->57454 57455 ab99a6 57453->57455 57456 b1c950 std::_Facet_Register 4 API calls 57454->57456 57457 a42700 4 API calls 57455->57457 57482 ab9804 57456->57482 57458 ab99b4 57457->57458 57460 aa98d0 4 API calls 57458->57460 57459 ab993f 57463 ab9959 57459->57463 57466 aaba40 3 API calls 57459->57466 57462 ab99c9 57460->57462 57461 aa3560 4 API calls 57461->57482 57465 a48920 4 API calls 57462->57465 57464 aaba40 3 API calls 57463->57464 57468 ab9986 57464->57468 57469 ab99de Concurrency::cancel_current_task 57465->57469 57466->57463 57467 aa5a60 4 API calls 57467->57482 57468->57335 57470 b21e70 3 API calls 57469->57470 57471 ab99f4 57470->57471 57575 abaef0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Locinfo::_Locinfo_ctor 57471->57575 57474 ab9a9f 57579 aacf70 ExitProcess RtlAllocateHeap RtlFreeHeap 57474->57579 57476 ab9aa9 57580 aa2c10 ExitProcess RtlAllocateHeap RtlFreeHeap 57476->57580 57478 ab9a29 57478->57474 57484 ab9ac6 57478->57484 57576 abad90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Locinfo::_Locinfo_ctor 57478->57576 57577 abac30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Locinfo::_Locinfo_ctor 57478->57577 57578 ab68c0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57478->57578 57482->57459 57482->57461 57482->57467 57482->57469 57562 abdea0 57482->57562 57484->57474 57581 abaef0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Locinfo::_Locinfo_ctor 57484->57581 57486 ab9bad 57490 abad90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57497 ab9ad9 57490->57497 57491 abac30 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57491->57497 57497->57486 57497->57490 57497->57491 57582 ab68c0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57497->57582 57499 aaba83 57498->57499 57502 aaba53 57498->57502 57499->57335 57500 aaba40 3 API calls 57500->57502 57502->57499 57502->57500 57588 ab30f0 57502->57588 57563 abded2 57562->57563 57564 abdee5 57563->57564 57565 abdf08 57563->57565 57566 abdf93 57563->57566 57564->57482 57567 b1c950 std::_Facet_Register 4 API calls 57565->57567 57587 a47d60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57566->57587 57570 abdf22 57567->57570 57569 abdf98 57571 b2ae96 ___std_exception_destroy 2 API calls 57569->57571 57572 aa5a60 4 API calls 57570->57572 57574 abdfae 57571->57574 57573 abdf3c 57572->57573 57573->57482 57574->57482 57575->57478 57576->57478 57577->57478 57578->57478 57579->57476 57581->57497 57582->57497 57587->57569 57589 ab30fb 57588->57589 57594 aac0a0 57595 aac0cd 57594->57595 57596 aac0a7 57594->57596 57596->57595 57597 b21e70 3 API calls 57596->57597 57598 aa7c60 57597->57598 57599 aa7cac 57598->57599 57600 aaad50 4 API calls 57598->57600 57601 aa7c73 57600->57601 57601->57599 57602 b21e70 3 API calls 57601->57602 57603 aa7cd4 57602->57603 57614 a43b70 4 API calls 2 library calls 57603->57614 57605 aa7d81 57606 b1c950 std::_Facet_Register 4 API calls 57605->57606 57607 aa7d88 57606->57607 57615 b1b75e 4 API calls 6 library calls 57607->57615 57609 aa7d9b 57616 aa9240 5 API calls 4 library calls 57609->57616 57611 aa7dce 57612 aa7e12 57611->57612 57617 a43b70 4 API calls 2 library calls 57611->57617 57614->57605 57615->57609 57616->57611 57617->57612 52862 a5a100 52863 a5a16f __fread_nolock 52862->52863 52864 a5a42f 52863->52864 52865 a5a27f 52863->52865 52945 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 52864->52945 52924 aad420 52865->52924 52868 a5a2a5 52939 aa57e0 52868->52939 52869 a5a434 52946 b21e70 52869->52946 52872 a5a2b6 52872->52869 52873 a5a317 52872->52873 52944 a42cc0 ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 52873->52944 52874 b21e70 3 API calls 52880 a5a43e 52874->52880 52876 b21e70 3 API calls 52877 a5c2aa 52876->52877 52878 a5a412 52879 a5a352 52879->52874 52879->52878 52900 a5c15b Concurrency::cancel_current_task 52880->52900 52949 a42810 52880->52949 52882 a5c1ed 52883 a5a54c 52965 aa5a60 52883->52965 52885 a5a55f 52982 a4c3e0 52885->52982 52900->52876 52900->52882 52925 aad453 52924->52925 52929 aad47e std::_Locinfo::_Locinfo_ctor 52924->52929 52926 aad460 52925->52926 52927 aad4a3 52925->52927 52930 aad4ac 52925->52930 53080 b1c950 52926->53080 52927->52926 52928 aad4fd 52927->52928 53088 a41fa0 4 API calls 2 library calls 52928->53088 52929->52868 52930->52929 52932 b1c950 std::_Facet_Register 4 API calls 52930->52932 52932->52929 52933 aad473 52933->52929 52935 b21e70 3 API calls 52933->52935 52936 aad507 52935->52936 53089 b2ae96 52936->53089 52938 aad524 52938->52868 52940 aa57f4 52939->52940 52943 aa5804 std::_Locinfo::_Locinfo_ctor 52940->52943 53114 aab810 4 API calls 3 library calls 52940->53114 52942 aa584a 52942->52872 52943->52872 52944->52879 53115 b21dac ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 52946->53115 52948 b21e7f __Getctype 52950 a428d5 52949->52950 52951 a42826 52949->52951 53116 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 52950->53116 52953 a42832 std::_Locinfo::_Locinfo_ctor 52951->52953 52956 a42895 52951->52956 52959 a4285a 52951->52959 52960 a4289e 52951->52960 52953->52883 52954 a428da 53117 a41fa0 4 API calls 2 library calls 52954->53117 52956->52954 52956->52959 52957 b1c950 std::_Facet_Register 4 API calls 52958 a4286d 52957->52958 52961 b21e70 3 API calls 52958->52961 52964 a42876 std::_Locinfo::_Locinfo_ctor 52958->52964 52959->52957 52962 b1c950 std::_Facet_Register 4 API calls 52960->52962 52960->52964 52963 a428e4 52961->52963 52962->52964 52964->52883 52966 aa5a8a 52965->52966 52967 aa5b42 52966->52967 52971 aa5a9b 52966->52971 53118 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 52967->53118 52969 aa5aa7 std::_Locinfo::_Locinfo_ctor 52969->52885 52970 aa5acc 52976 b1c950 std::_Facet_Register 4 API calls 52970->52976 52971->52969 52971->52970 52974 aa5b0e 52971->52974 52975 aa5b05 52971->52975 52972 aa5b47 53119 a41fa0 4 API calls 2 library calls 52972->53119 52979 b1c950 std::_Facet_Register 4 API calls 52974->52979 52980 aa5ae6 std::_Locinfo::_Locinfo_ctor 52974->52980 52975->52970 52975->52972 52977 aa5adf 52976->52977 52977->52980 52979->52980 52980->52885 53082 b1c955 std::_Facet_Register 53080->53082 53083 b1c96f 53082->53083 53085 a41fa0 Concurrency::cancel_current_task 53082->53085 53092 b2b5ec 53082->53092 53083->52933 53084 b1c97b 53084->53084 53085->53084 53098 b1dd11 53085->53098 53088->52933 53108 b34473 53089->53108 53097 b344ed __dosmaperr std::_Facet_Register 53092->53097 53093 b3452b 53106 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 53093->53106 53095 b34516 RtlAllocateHeap 53096 b34529 53095->53096 53095->53097 53096->53082 53097->53093 53097->53095 53099 a41fe3 53098->53099 53100 b1dd1e 53098->53100 53099->52933 53100->53099 53101 b2b5ec ___std_exception_copy 3 API calls 53100->53101 53102 b1dd3b 53101->53102 53103 b1dd4b 53102->53103 53107 b32d78 ExitProcess RtlAllocateHeap RtlFreeHeap __dosmaperr ___std_exception_copy 53102->53107 53105 b2ae96 ___std_exception_destroy 2 API calls 53103->53105 53105->53099 53106->53096 53107->53103 53109 b3447e RtlFreeHeap 53108->53109 53112 b2aeae 53108->53112 53110 b34493 __dosmaperr 53109->53110 53109->53112 53113 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 53110->53113 53112->52938 53113->53112 53114->52942 53115->52948 53117->52958 53119->52977 60196 a92f90 60207 a92fb6 60196->60207 60197 a93536 60198 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60198->60207 60203 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60203->60207 60204 aa3560 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60204->60207 60205 aa3160 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60205->60207 60207->60197 60207->60198 60207->60203 60207->60204 60207->60205 60208 a743e0 60207->60208 60272 a76840 60207->60272 60327 a77900 60207->60327 60385 a78f30 60207->60385 60434 a7a9a0 60207->60434 60209 a74416 60208->60209 60210 aa38a0 4 API calls 60209->60210 60211 a7445e 60210->60211 60212 aa9b20 4 API calls 60211->60212 60213 a74483 __fread_nolock 60212->60213 60214 aa9870 4 API calls 60213->60214 60215 a744ce 60214->60215 60216 aa97b0 4 API calls 60215->60216 60249 a74520 __fread_nolock std::_Locinfo::_Locinfo_ctor __Mtx_unlock 60216->60249 60218 b21e70 3 API calls 60220 a767aa 60218->60220 60219 a7674b 60219->60207 60222 a42700 4 API calls 60220->60222 60221 a7660a 60221->60218 60221->60219 60223 a767c1 60222->60223 60225 aa98d0 4 API calls 60223->60225 60224 aa9810 4 API calls 60224->60249 60258 a76779 60225->60258 60226 a48920 4 API calls 60227 a767ee Concurrency::cancel_current_task 60226->60227 60517 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60227->60517 60229 a76807 60518 b1bb7b 8 API calls std::locale::_Setgloballocale 60229->60518 60232 b22a20 ExitProcess RtlAllocateHeap RtlFreeHeap 60232->60249 60233 aa5a60 4 API calls 60233->60249 60234 a4b890 9 API calls 60234->60249 60235 aa9eb0 5 API calls 60235->60249 60236 a544f0 14 API calls 60236->60249 60238 a54920 10 API calls 60238->60249 60239 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60239->60249 60240 aa26a0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60240->60249 60243 aa3560 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60243->60249 60245 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 60245->60249 60246 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60246->60249 60247 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60247->60249 60248 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60248->60249 60249->60220 60249->60221 60249->60224 60249->60227 60249->60229 60249->60232 60249->60233 60249->60234 60249->60235 60249->60236 60249->60238 60249->60239 60249->60240 60249->60243 60249->60245 60249->60246 60249->60247 60249->60248 60251 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60251 60252 a7674d 60249->60252 60253 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60253 60256 b1bed2 GetSystemTimePreciseAsFileTime 60249->60256 60259 aacba0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60259 60260 aaa3b0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60260 60261 aa9c60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60261 60262 aa97b0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60262 60263 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60263 60264 a4beb0 7 API calls 60249->60264 60265 aa98d0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60265 60266 a42700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60266 60267 aa3290 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60267 60268 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60268 60269 b2a828 6 API calls 60249->60269 60270 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 60249->60270 60271 b262a8 7 API calls 60249->60271 60486 b2a1ae 60249->60486 60500 b02410 60249->60500 60503 adf410 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60249->60503 60504 adeaf0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60249->60504 60505 aa27b0 60249->60505 60516 aab810 4 API calls 3 library calls 60249->60516 60251->60249 60254 a42700 4 API calls 60252->60254 60253->60249 60255 a76764 60254->60255 60257 aa98d0 4 API calls 60255->60257 60256->60249 60257->60258 60258->60226 60259->60249 60260->60249 60261->60249 60262->60249 60263->60249 60264->60249 60265->60249 60266->60249 60267->60249 60268->60249 60269->60249 60270->60249 60271->60249 60273 a76876 60272->60273 60274 aa38a0 4 API calls 60273->60274 60275 a768c0 60274->60275 60276 aa9b20 4 API calls 60275->60276 60277 a768fc __fread_nolock 60276->60277 60277->60277 60278 a77840 60277->60278 60279 aad420 4 API calls 60277->60279 60554 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60278->60554 60284 a7699f 60279->60284 60281 a77845 60555 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60281->60555 60283 b21e70 3 API calls 60285 a7784f 60283->60285 60284->60281 60284->60284 60286 aad420 4 API calls 60284->60286 60287 a42700 4 API calls 60285->60287 60325 a76a2f __fread_nolock 60286->60325 60288 a77866 60287->60288 60289 aa98d0 4 API calls 60288->60289 60290 a7787b 60289->60290 60291 a48920 4 API calls 60290->60291 60293 a77893 Concurrency::cancel_current_task 60291->60293 60292 b2a1ae 4 API calls 60292->60325 60294 a42700 4 API calls 60293->60294 60295 a778bb 60294->60295 60296 aa98d0 4 API calls 60295->60296 60297 a778d0 60296->60297 60298 a48920 4 API calls 60297->60298 60300 a778e8 Concurrency::cancel_current_task 60298->60300 60299 a7781d 60299->60207 60301 a7776c 60301->60283 60301->60299 60302 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60302->60325 60303 aa5770 4 API calls 60303->60325 60304 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60304->60325 60305 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60305->60325 60306 b22a20 3 API calls 60306->60325 60307 a4c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60307->60325 60308 b262a8 7 API calls 60308->60325 60309 aa7c60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 60309->60325 60310 aa5640 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60310->60325 60311 aa38a0 4 API calls 60311->60325 60312 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 60312->60325 60314 a544f0 14 API calls 60314->60325 60315 b022d0 3 API calls 60315->60325 60316 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60316->60325 60317 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60317->60325 60318 a54920 10 API calls 60318->60325 60321 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60321->60325 60322 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60322->60325 60323 aacba0 4 API calls 60323->60325 60325->60278 60325->60285 60325->60292 60325->60293 60325->60301 60325->60302 60325->60303 60325->60304 60325->60305 60325->60306 60325->60307 60325->60308 60325->60309 60325->60310 60325->60311 60325->60312 60325->60314 60325->60315 60325->60316 60325->60317 60325->60318 60325->60321 60325->60322 60325->60323 60326 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60325->60326 60526 aa7640 60325->60526 60536 aa3160 60325->60536 60552 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60325->60552 60553 addc10 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60325->60553 60326->60325 60328 a77936 60327->60328 60329 aa38a0 4 API calls 60328->60329 60330 a77983 60329->60330 60331 aa9b20 4 API calls 60330->60331 60332 a779c8 __fread_nolock 60331->60332 60332->60332 60333 a78e2f 60332->60333 60334 aad420 4 API calls 60332->60334 60559 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60333->60559 60338 a77a80 60334->60338 60336 a78e34 60560 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60336->60560 60338->60336 60338->60338 60343 aad420 4 API calls 60338->60343 60339 b21e70 3 API calls 60340 a78e3e 60339->60340 60561 aa9030 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60340->60561 60342 a78e43 60344 a42700 4 API calls 60342->60344 60382 a77b0f __fread_nolock 60343->60382 60345 a78e5a 60344->60345 60346 aa98d0 4 API calls 60345->60346 60347 a78e6f 60346->60347 60348 a48920 4 API calls 60347->60348 60350 a78e87 Concurrency::cancel_current_task 60348->60350 60349 b2a1ae 4 API calls 60349->60382 60351 a42700 4 API calls 60350->60351 60352 a78eb2 60351->60352 60353 aa98d0 4 API calls 60352->60353 60355 a78ec7 60353->60355 60354 a78e0c 60354->60207 60357 a48920 4 API calls 60355->60357 60356 a78d57 60356->60339 60356->60354 60358 a78edf Concurrency::cancel_current_task 60357->60358 60359 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60359->60382 60360 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60360->60382 60361 a4c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60361->60382 60362 b22a20 3 API calls 60362->60382 60363 b262a8 7 API calls 60363->60382 60364 aa7c60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 60364->60382 60365 aa5640 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60365->60382 60366 aa38a0 4 API calls 60366->60382 60367 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 60367->60382 60368 aa7640 4 API calls 60368->60382 60369 a544f0 14 API calls 60369->60382 60370 b022d0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60370->60382 60371 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60371->60382 60372 a54920 10 API calls 60372->60382 60373 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60373->60382 60376 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60376->60382 60377 aa98d0 4 API calls 60377->60382 60378 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60378->60382 60379 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60379->60382 60380 aacba0 4 API calls 60380->60382 60381 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60381->60382 60382->60333 60382->60340 60382->60342 60382->60349 60382->60350 60382->60356 60382->60359 60382->60360 60382->60361 60382->60362 60382->60363 60382->60364 60382->60365 60382->60366 60382->60367 60382->60368 60382->60369 60382->60370 60382->60371 60382->60372 60382->60373 60382->60376 60382->60377 60382->60378 60382->60379 60382->60380 60382->60381 60382->60382 60383 aa3160 4 API calls 60382->60383 60384 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60382->60384 60557 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60382->60557 60558 addc10 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60382->60558 60383->60382 60384->60382 60386 a78f66 60385->60386 60387 aa38a0 4 API calls 60386->60387 60388 a78fb3 60387->60388 60389 aa9b20 4 API calls 60388->60389 60390 a78fed __fread_nolock 60389->60390 60390->60390 60391 a7a92a 60390->60391 60393 aad420 4 API calls 60390->60393 60564 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60391->60564 60397 a790a5 60393->60397 60394 a7a92f 60565 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60394->60565 60396 b21e70 3 API calls 60398 a7a939 60396->60398 60397->60394 60397->60397 60399 aad420 4 API calls 60397->60399 60400 a42700 4 API calls 60398->60400 60429 a79138 __fread_nolock 60399->60429 60401 a7a950 60400->60401 60402 aa98d0 4 API calls 60401->60402 60403 a7a965 60402->60403 60404 a48920 4 API calls 60403->60404 60405 a7a97d Concurrency::cancel_current_task 60404->60405 60406 b2a1ae 4 API calls 60406->60429 60407 a7a907 60407->60207 60408 a7a856 60408->60396 60408->60407 60409 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60409->60429 60410 aa5770 4 API calls 60410->60429 60411 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60411->60429 60412 b22a20 3 API calls 60412->60429 60413 a4c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60413->60429 60414 b262a8 7 API calls 60414->60429 60415 aa5640 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60415->60429 60416 aa7c60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 60416->60429 60417 aa38a0 4 API calls 60417->60429 60418 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 60418->60429 60419 aa7640 4 API calls 60419->60429 60420 a544f0 14 API calls 60420->60429 60421 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60421->60429 60422 b022d0 3 API calls 60422->60429 60423 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60423->60429 60424 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60424->60429 60425 a54920 10 API calls 60425->60429 60428 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60428->60429 60429->60391 60429->60398 60429->60406 60429->60408 60429->60409 60429->60410 60429->60411 60429->60412 60429->60413 60429->60414 60429->60415 60429->60416 60429->60417 60429->60418 60429->60419 60429->60420 60429->60421 60429->60422 60429->60423 60429->60424 60429->60425 60429->60428 60430 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60429->60430 60431 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60429->60431 60432 b2a4f6 4 API calls 60429->60432 60433 aa3160 4 API calls 60429->60433 60562 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60429->60562 60563 addc10 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60429->60563 60430->60429 60431->60429 60432->60429 60433->60429 60435 a7a9d6 60434->60435 60436 aa38a0 4 API calls 60435->60436 60437 a7aa23 60436->60437 60438 aa9b20 4 API calls 60437->60438 60439 a7aa5c __fread_nolock 60438->60439 60439->60439 60440 a7bc2f 60439->60440 60442 aad420 4 API calls 60439->60442 60568 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60440->60568 60446 a7ab14 60442->60446 60443 a7bc34 60569 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60443->60569 60445 b21e70 3 API calls 60447 a7bc3e 60445->60447 60446->60443 60446->60446 60448 aad420 4 API calls 60446->60448 60449 a42700 4 API calls 60447->60449 60482 a7ab9f __fread_nolock __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 60448->60482 60450 a7bc55 60449->60450 60451 aa98d0 4 API calls 60450->60451 60452 a7bc6a 60451->60452 60453 a48920 4 API calls 60452->60453 60455 a7bc82 Concurrency::cancel_current_task 60453->60455 60454 b2a1ae 4 API calls 60454->60482 60456 a7bcde LoadLibraryA 60455->60456 60461 a7bcfc 60455->60461 60456->60461 60457 a7bc0c 60457->60207 60458 a7bb5b 60458->60445 60458->60457 60459 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60459->60482 60460 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60460->60482 60461->60207 60461->60461 60462 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60462->60482 60463 b22a20 3 API calls 60463->60482 60464 a4c3e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60464->60482 60465 b262a8 7 API calls 60465->60482 60466 aa7c60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap RtlAllocateHeap 60466->60482 60467 aa5640 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60467->60482 60468 aa38a0 4 API calls 60468->60482 60469 aa7640 4 API calls 60469->60482 60470 a544f0 14 API calls 60470->60482 60471 a54920 10 API calls 60471->60482 60472 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60472->60482 60475 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60475->60482 60476 aa98d0 4 API calls 60476->60482 60477 b022d0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60477->60482 60478 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60478->60482 60479 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 60479->60482 60480 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60480->60482 60481 b2a4f6 4 API calls 60481->60482 60482->60440 60482->60447 60482->60454 60482->60458 60482->60459 60482->60460 60482->60462 60482->60463 60482->60464 60482->60465 60482->60466 60482->60467 60482->60468 60482->60469 60482->60470 60482->60471 60482->60472 60482->60475 60482->60476 60482->60477 60482->60478 60482->60479 60482->60480 60482->60481 60483 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60482->60483 60484 aa3160 4 API calls 60482->60484 60485 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60482->60485 60566 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60482->60566 60567 addc10 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 60482->60567 60483->60482 60484->60482 60485->60482 60487 b2a205 60486->60487 60488 b2a1bd 60486->60488 60523 b2a21b 4 API calls 3 library calls 60487->60523 60490 b2a1c3 60488->60490 60493 b2a1e0 60488->60493 60519 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 60490->60519 60491 b2a1d3 60491->60249 60499 b2a1fe 60493->60499 60521 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 60493->60521 60494 b2a1c8 60520 b21e60 ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 60494->60520 60497 b2a1ef 60522 b21e60 ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 60497->60522 60499->60249 60501 b022d0 3 API calls 60500->60501 60502 b02423 60501->60502 60502->60249 60503->60249 60504->60249 60506 aa280c 60505->60506 60509 aa27d5 Concurrency::cancel_current_task 60505->60509 60507 a42700 4 API calls 60506->60507 60508 aa2819 60507->60508 60524 a48740 4 API calls 2 library calls 60508->60524 60510 aa27e5 60509->60510 60512 a42700 4 API calls 60509->60512 60510->60249 60513 aa284f 60512->60513 60525 a48740 4 API calls 2 library calls 60513->60525 60515 aa2867 Concurrency::cancel_current_task 60516->60249 60519->60494 60520->60491 60521->60497 60522->60491 60523->60491 60524->60509 60525->60515 60527 aa7670 60526->60527 60528 aa7729 60527->60528 60529 aa76ae 60527->60529 60535 aa76e2 60527->60535 60556 a47d60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60528->60556 60530 b1c950 std::_Facet_Register 4 API calls 60529->60530 60532 aa76c8 60530->60532 60534 aa5a60 4 API calls 60532->60534 60533 aa772e 60534->60535 60535->60325 60537 aa31b8 60536->60537 60538 aa3185 60536->60538 60539 aa31da 60537->60539 60540 aa31f8 60537->60540 60541 b1c950 std::_Facet_Register 4 API calls 60538->60541 60542 aa7640 4 API calls 60539->60542 60546 a42700 4 API calls 60540->60546 60543 aa318f 60541->60543 60545 aa31e5 60542->60545 60544 b1c950 std::_Facet_Register 4 API calls 60543->60544 60544->60537 60545->60325 60547 aa3208 60546->60547 60548 aa98d0 4 API calls 60547->60548 60549 aa321d 60548->60549 60550 a48920 4 API calls 60549->60550 60551 aa3232 Concurrency::cancel_current_task 60550->60551 60551->60325 60552->60325 60553->60325 60556->60533 60557->60382 60558->60382 60562->60429 60563->60429 60566->60482 60567->60482 53240 a5db60 WSAStartup 53241 a5db98 53240->53241 53244 a5dc56 53240->53244 53242 a5dc24 socket 53241->53242 53241->53244 53243 a5dc3a connect 53242->53243 53242->53244 53243->53244 53245 a5dc4c closesocket 53243->53245 53245->53242 53245->53244 57699 b2c8e2 57702 b2c752 57699->57702 57703 b2c77f std::locale::_Setgloballocale 57702->57703 57709 b2c5e3 57703->57709 57705 b2c7c8 57706 b2c7ce 57705->57706 57713 b2c7e9 57705->57713 57710 b2c5ef __fread_nolock std::_Lockit::_Lockit 57709->57710 57716 b2c66a 57710->57716 57712 b2c606 std::locale::_Setgloballocale 57712->57705 57714 b2c7f3 std::locale::_Setgloballocale 57713->57714 57715 b2c80f ExitProcess 57714->57715 57718 b2c676 __fread_nolock std::locale::_Setgloballocale 57716->57718 57717 b2c6da std::locale::_Setgloballocale 57717->57712 57718->57717 57720 b2fae4 RtlAllocateHeap RtlFreeHeap __EH_prolog3 std::locale::_Init std::locale::_Setgloballocale 57718->57720 57720->57717 57721 a8ddf0 57746 a8de32 57721->57746 57722 a8ed6c 58261 a80600 57722->58261 57724 a8ed7e 58290 aa9b20 57724->58290 57726 a8eda2 57727 aa3560 4 API calls 57726->57727 57728 a8edb0 57727->57728 57729 aa9b20 4 API calls 57728->57729 57730 a8edd9 57729->57730 57731 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57731->57746 57732 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57732->57746 57735 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57735->57746 57737 aa3160 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57737->57746 57738 a68070 17 API calls 57738->57746 57739 a42700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57739->57746 57740 aa3560 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57740->57746 57746->57722 57746->57731 57746->57732 57746->57735 57746->57737 57746->57738 57746->57739 57746->57740 57747 a8ef00 8 API calls 57746->57747 57748 a62ed0 57746->57748 57795 a64230 57746->57795 57853 a65590 57746->57853 57984 a6a260 57746->57984 58043 a6b560 57746->58043 58179 a70b10 57746->58179 58288 ab0df0 8 API calls 2 library calls 57746->58288 58289 aa2290 ExitProcess RtlAllocateHeap RtlFreeHeap 57746->58289 57747->57746 57749 a62f2a 57748->57749 58306 aa38a0 57749->58306 57752 aa9b20 4 API calls 57753 a62f8f __fread_nolock 57752->57753 57753->57753 57754 a6419b 57753->57754 57756 aad420 4 API calls 57753->57756 58389 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57754->58389 57757 a6304f 57756->57757 57759 a63081 57757->57759 57760 a634eb 57757->57760 57758 b21e70 3 API calls 57762 a641a5 57758->57762 57763 aa5a60 4 API calls 57759->57763 57761 ab25d0 4 API calls 57760->57761 57765 a63525 57761->57765 57764 a42700 4 API calls 57762->57764 57772 a63092 57763->57772 57767 a641bc 57764->57767 57769 ab25d0 4 API calls 57765->57769 57765->57772 57793 a635ab std::_Locinfo::_Locinfo_ctor 57765->57793 57766 a64107 57770 aa7c60 5 API calls 57766->57770 57768 aa98d0 4 API calls 57767->57768 57771 a641d1 57768->57771 57769->57793 57770->57772 57773 a48920 4 API calls 57771->57773 57772->57758 57774 a6317d 57772->57774 57776 a641e9 Concurrency::cancel_current_task 57773->57776 57774->57746 57775 aa38a0 4 API calls 57775->57793 57777 aa3160 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57777->57793 57778 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57778->57793 57779 aad230 4 API calls 57779->57793 57782 aa9b20 4 API calls 57782->57793 57787 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57787->57793 57788 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 57788->57793 57789 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57789->57793 57790 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57790->57793 57791 aacba0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57791->57793 57792 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57792->57793 57793->57754 57793->57762 57793->57766 57793->57772 57793->57775 57793->57777 57793->57778 57793->57779 57793->57782 57793->57787 57793->57788 57793->57789 57793->57790 57793->57791 57793->57792 57794 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57793->57794 58309 a544f0 57793->58309 58355 b022d0 57793->58355 58368 a54920 57793->58368 58386 aab810 4 API calls 3 library calls 57793->58386 58387 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57793->58387 58388 addc10 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57793->58388 57794->57793 57796 a6428a 57795->57796 57797 aa38a0 4 API calls 57796->57797 57798 a642af 57797->57798 57799 aa9b20 4 API calls 57798->57799 57800 a642f8 __fread_nolock 57799->57800 57800->57800 57801 a65527 57800->57801 57802 aad420 4 API calls 57800->57802 59162 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57801->59162 57804 a643af 57802->57804 57806 a64864 57804->57806 57807 a643e1 57804->57807 57805 b21e70 3 API calls 57808 a65531 57805->57808 57810 ab25d0 4 API calls 57806->57810 57809 aa5a60 4 API calls 57807->57809 57812 a42700 4 API calls 57808->57812 57811 a643f2 57809->57811 57819 a64862 57810->57819 57813 a64423 57811->57813 57838 a644e2 57811->57838 57814 a65545 57812->57814 57815 aa7c60 5 API calls 57813->57815 57818 aa98d0 4 API calls 57814->57818 57829 a6442b 57815->57829 57816 a65493 57823 aa7c60 5 API calls 57816->57823 57817 a64853 57822 aa7c60 5 API calls 57817->57822 57820 a6555a 57818->57820 57821 ab25d0 4 API calls 57819->57821 57819->57829 57849 a64924 std::_Locinfo::_Locinfo_ctor 57819->57849 57824 a48920 4 API calls 57820->57824 57821->57849 57822->57819 57823->57829 57825 a65572 Concurrency::cancel_current_task 57824->57825 57826 a644dd 57826->57746 57827 aa38a0 4 API calls 57827->57849 57828 aad420 4 API calls 57828->57838 57829->57805 57829->57826 57830 aa3160 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57830->57849 57831 aa57e0 4 API calls 57831->57838 57832 aa7c60 5 API calls 57832->57838 57833 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57833->57849 57834 aad230 4 API calls 57834->57849 57835 aa5a60 4 API calls 57835->57838 57838->57801 57838->57817 57838->57828 57838->57829 57838->57831 57838->57832 57838->57835 59158 ab26f0 4 API calls 3 library calls 57838->59158 57839 a544f0 14 API calls 57839->57849 57840 aa9b20 4 API calls 57840->57849 57841 b022d0 3 API calls 57841->57849 57842 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57842->57849 57843 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57843->57849 57844 a54920 10 API calls 57844->57849 57847 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57847->57849 57848 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57848->57849 57849->57801 57849->57808 57849->57816 57849->57827 57849->57829 57849->57830 57849->57833 57849->57834 57849->57839 57849->57840 57849->57841 57849->57842 57849->57843 57849->57844 57849->57847 57849->57848 57850 aacba0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57849->57850 57851 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 57849->57851 57852 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57849->57852 59159 aab810 4 API calls 3 library calls 57849->59159 59160 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57849->59160 59161 addc10 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 57849->59161 57850->57849 57851->57849 57852->57849 57854 a655e3 57853->57854 57855 aa38a0 4 API calls 57854->57855 57856 a6560e 57855->57856 57857 aa9b20 4 API calls 57856->57857 57858 a65645 __fread_nolock 57857->57858 57859 aa9870 4 API calls 57858->57859 57860 a6569d 57859->57860 57861 a658b5 57860->57861 57862 a656ca 57860->57862 57864 a42700 4 API calls 57861->57864 57863 aa5a60 4 API calls 57862->57863 57869 a656db 57863->57869 57865 a658c5 57864->57865 59240 aa4700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57865->59240 57867 a658d8 57868 a42660 3 API calls 57867->57868 57874 a658b3 57868->57874 57870 a65700 57869->57870 57929 a6571d 57869->57929 57871 aa7c60 5 API calls 57870->57871 57872 a65705 57871->57872 57875 aa7c60 5 API calls 57872->57875 57873 a65925 57883 aa97b0 4 API calls 57873->57883 57874->57873 57876 a42700 4 API calls 57874->57876 57878 a6570d 57875->57878 57879 a65903 57876->57879 57877 a658a4 57880 aa7c60 5 API calls 57877->57880 57881 a42660 3 API calls 57878->57881 59241 aa4700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57879->59241 57880->57874 57932 a65718 57881->57932 57885 a65952 57883->57885 57884 a65916 57887 a42660 3 API calls 57884->57887 57886 aa99d0 4 API calls 57885->57886 57888 a65966 57886->57888 57887->57873 57891 a4beb0 7 API calls 57888->57891 57889 a42660 3 API calls 57892 a67fe0 57889->57892 57890 aa97b0 4 API calls 57890->57929 57893 a6596e 57891->57893 57894 a42660 3 API calls 57892->57894 57896 a42660 3 API calls 57893->57896 57897 a67fe8 57894->57897 57895 aa99d0 4 API calls 57895->57929 57898 a42660 3 API calls 57897->57898 57901 a42660 3 API calls 57901->57929 57910 aa7c60 5 API calls 57910->57929 57929->57877 57929->57890 57929->57895 57929->57901 57929->57910 59239 aa4760 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57929->59239 57932->57889 57985 a6a2ba 57984->57985 57986 aa38a0 4 API calls 57985->57986 57987 a6a2e2 57986->57987 57988 aa9b20 4 API calls 57987->57988 57989 a6a31d __fread_nolock 57988->57989 57989->57989 57990 a6b4f1 57989->57990 57992 aad420 4 API calls 57989->57992 59633 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 57990->59633 57993 a6a3e2 57992->57993 57995 a6a414 57993->57995 57996 a6a88b 57993->57996 57994 b21e70 3 API calls 57997 a6b4fb 57994->57997 57998 aa5a60 4 API calls 57995->57998 57999 ab25d0 4 API calls 57996->57999 58001 a42700 4 API calls 57997->58001 58000 a6a425 57998->58000 58006 a6a889 57999->58006 58003 a6a456 58000->58003 58027 a6a515 58000->58027 58002 a6b512 58001->58002 58007 aa98d0 4 API calls 58002->58007 58008 aa7c60 5 API calls 58003->58008 58004 a6b45d 58009 aa7c60 5 API calls 58004->58009 58005 a6a87a 58011 aa7c60 5 API calls 58005->58011 58010 ab25d0 4 API calls 58006->58010 58019 a6a45e 58006->58019 58030 a6a94b __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z std::_Locinfo::_Locinfo_ctor 58006->58030 58012 a6b527 58007->58012 58008->58019 58009->58019 58010->58030 58011->58006 58013 a48920 4 API calls 58012->58013 58014 a6b53f Concurrency::cancel_current_task 58013->58014 58015 aa38a0 4 API calls 58015->58030 58016 a6a510 58016->57746 58017 aad420 4 API calls 58017->58027 58018 aa3160 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58018->58030 58019->57994 58019->58016 58020 aa57e0 4 API calls 58020->58027 58021 aa7c60 5 API calls 58021->58027 58022 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58022->58030 58023 aad230 4 API calls 58023->58030 58025 aa5a60 4 API calls 58025->58027 58027->57990 58027->58005 58027->58017 58027->58019 58027->58020 58027->58021 58027->58025 59615 ab26f0 4 API calls 3 library calls 58027->59615 58028 a544f0 14 API calls 58028->58030 58029 b022d0 3 API calls 58029->58030 58030->57990 58030->57997 58030->58004 58030->58015 58030->58018 58030->58019 58030->58022 58030->58023 58030->58028 58030->58029 58031 a54920 10 API calls 58030->58031 58034 b1c950 std::_Facet_Register 4 API calls 58030->58034 58035 acd5c0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 58030->58035 58036 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58030->58036 58037 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58030->58037 58038 adbad0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 58030->58038 58041 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58030->58041 58042 adec00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 58030->58042 59616 aab810 4 API calls 3 library calls 58030->59616 59617 b2a4f6 58030->59617 59623 aacba0 58030->59623 59631 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 58030->59631 59632 addc10 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 58030->59632 58031->58030 58034->58030 58035->58030 58036->58030 58037->58030 58038->58030 58041->58030 58042->58030 58044 a6b5b3 58043->58044 58045 aa38a0 4 API calls 58044->58045 58046 a6b5dd 58045->58046 58047 aa9b20 4 API calls 58046->58047 58048 a6b609 __fread_nolock 58047->58048 58049 aa9870 4 API calls 58048->58049 58050 a6b661 58049->58050 58051 a6b694 58050->58051 58052 a6ba2e 58050->58052 58053 aa5a60 4 API calls 58051->58053 58054 a42700 4 API calls 58052->58054 58059 a6b6a5 58053->58059 58055 a6ba3e 58054->58055 59670 aa4700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58055->59670 58057 a6ba54 58058 a42660 3 API calls 58057->58058 58060 a6ba2c 58058->58060 58061 a6b6c3 58059->58061 58128 a6b6fb 58059->58128 58065 a42700 4 API calls 58060->58065 58072 a6babc 58060->58072 58063 aa7c60 5 API calls 58061->58063 58062 a6ba1d 58066 aa7c60 5 API calls 58062->58066 58064 a6b6c8 58063->58064 58067 aa7c60 5 API calls 58064->58067 58068 a6ba97 58065->58068 58066->58060 58069 a6b6d3 58067->58069 59671 aa4700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58068->59671 58074 a42660 3 API calls 58069->58074 58071 a6d8f4 59694 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58071->59694 58072->58071 58073 aad420 4 API calls 58072->58073 58077 a6bb1d 58073->58077 58078 a6b6de 58074->58078 58076 a6baad 58080 a42660 3 API calls 58076->58080 58086 a6bb52 std::_Locinfo::_Locinfo_ctor 58077->58086 59672 aab810 4 API calls 3 library calls 58077->59672 58081 a42660 3 API calls 58078->58081 58079 a6d8f9 58082 b21e70 3 API calls 58079->58082 58080->58072 58084 a6b6e6 58081->58084 58085 a6d8fe 58082->58085 58087 a42660 3 API calls 58084->58087 59695 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58085->59695 58090 a4beb0 7 API calls 58086->58090 58091 a6b6ee 58087->58091 58088 aa97b0 4 API calls 58088->58128 58098 a6bbdd 58090->58098 58093 a42660 3 API calls 58091->58093 58094 aa99d0 4 API calls 58094->58128 58098->58079 58100 aa97b0 4 API calls 58098->58100 58102 a6bc9a 58098->58102 58103 a6bc62 58100->58103 58102->58085 58105 aad420 4 API calls 58102->58105 58109 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 58109->58128 58117 aa7c60 5 API calls 58117->58128 58125 aa5a60 4 API calls 58125->58128 58128->58062 58128->58088 58128->58094 58128->58109 58128->58117 58128->58125 59666 aa9810 58128->59666 59669 ab26f0 4 API calls 3 library calls 58128->59669 58180 a70b8f __fread_nolock 58179->58180 58180->58180 58181 a72532 58180->58181 58183 aad420 4 API calls 58180->58183 59777 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58181->59777 58184 a70bff 58183->58184 58186 a70c36 58184->58186 58187 a710ba 58184->58187 58185 b21e70 3 API calls 58190 a7253c 58185->58190 58188 aa5a60 4 API calls 58186->58188 58189 ab25d0 4 API calls 58187->58189 58192 a70c47 58188->58192 58200 a710b5 58189->58200 59778 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58190->59778 58196 a70c79 58192->58196 58238 a70d38 58192->58238 58193 a72541 58194 b21e70 3 API calls 58193->58194 58195 a72546 58194->58195 59779 aa9030 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58195->59779 58198 aa7c60 5 API calls 58196->58198 58212 a70c81 58198->58212 58199 a710a9 58201 aa7c60 5 API calls 58199->58201 58203 ab25d0 4 API calls 58200->58203 58205 a71174 58200->58205 58200->58212 58201->58200 58203->58205 58205->58190 58205->58205 58211 aad420 4 API calls 58205->58211 58205->58212 58207 a70d33 58207->57746 58210 aad420 4 API calls 58210->58238 58213 a712a7 58211->58213 58212->58185 58212->58207 58216 a4b890 9 API calls 58213->58216 58215 aa57e0 4 API calls 58215->58238 58217 a712bb 58216->58217 58220 aa9eb0 5 API calls 58217->58220 58255 a71470 58217->58255 58221 a71316 58220->58221 58226 aa9b20 4 API calls 58221->58226 58224 aa7c60 5 API calls 58224->58212 58225 aa7c60 5 API calls 58225->58238 58231 a71354 58226->58231 58228 a7240a 58228->58212 58228->58224 58230 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58230->58255 58232 aa9b20 4 API calls 58231->58232 58231->58255 58233 a71394 58232->58233 58237 aa9b20 4 API calls 58233->58237 58234 aa5a60 4 API calls 58234->58238 58236 a4b890 9 API calls 58236->58255 58239 a713d4 58237->58239 58238->58181 58238->58199 58238->58210 58238->58212 58238->58215 58238->58225 58238->58234 59769 ab26f0 4 API calls 3 library calls 58238->59769 58240 aa9b20 4 API calls 58239->58240 58239->58255 58242 a71414 58240->58242 58241 aa9eb0 5 API calls 58241->58255 58243 aa9b20 4 API calls 58242->58243 58244 a71454 58243->58244 58248 aad230 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58248->58255 58249 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58249->58255 58251 aa5770 4 API calls 58251->58255 58252 aa7c60 5 API calls 58252->58255 58255->58181 58255->58193 58255->58195 58255->58212 58255->58228 58255->58230 58255->58236 58255->58241 58255->58248 58255->58249 58255->58251 58255->58252 58256 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58255->58256 58260 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58255->58260 59729 a70390 58255->59729 59772 aa9c60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 58255->59772 59773 a42540 5 API calls std::_Locinfo::_Locinfo_ctor 58255->59773 59774 aa5640 4 API calls 3 library calls 58255->59774 59775 ab16d0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58255->59775 59776 aa2290 ExitProcess RtlAllocateHeap RtlFreeHeap 58255->59776 58256->58255 58260->58255 58262 a8064c 58261->58262 58263 aa38a0 4 API calls 58262->58263 58264 a8067f 58263->58264 58265 aa9b20 4 API calls 58264->58265 58287 a806a7 __fread_nolock 58265->58287 58266 a806ec RegOpenKeyExA 58266->58287 58267 a8147e 58267->57724 58268 aa5880 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58268->58287 58269 a5fe20 5 API calls 58269->58287 58270 b1c950 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 58270->58287 58271 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58271->58287 58272 a81497 58273 a42700 4 API calls 58272->58273 58274 a814ae 58273->58274 58275 aa98d0 4 API calls 58274->58275 58276 a814c3 58275->58276 58277 a48920 4 API calls 58276->58277 58278 a814db Concurrency::cancel_current_task 58277->58278 58279 b21e70 3 API calls 58278->58279 58280 a814f4 58279->58280 58281 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58281->58287 58282 aacba0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 58282->58287 58283 aa9b20 4 API calls 58283->58287 58286 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 58286->58287 58287->58266 58287->58267 58287->58268 58287->58269 58287->58270 58287->58271 58287->58272 58287->58278 58287->58281 58287->58282 58287->58283 58287->58286 59791 aa2e80 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 58287->59791 59792 a427b0 ExitProcess RtlAllocateHeap RtlFreeHeap 58287->59792 58288->57746 58289->57746 58291 aa9b58 58290->58291 58292 aa9c0e 58291->58292 58293 aa9b7a 58291->58293 58294 a42700 4 API calls 58292->58294 58293->58293 58295 a42810 4 API calls 58293->58295 58296 aa9c1e 58294->58296 58297 aa9bb3 58295->58297 58298 aa98d0 4 API calls 58296->58298 58299 aacba0 4 API calls 58297->58299 58300 aa9c33 58298->58300 58301 aa9bc5 Concurrency::cancel_current_task 58299->58301 58302 a48920 4 API calls 58300->58302 58303 aa9bed 58301->58303 58304 b21e70 3 API calls 58301->58304 58302->58301 58303->57726 58305 aa9c5e 58304->58305 58390 aa77b0 58306->58390 58310 a54555 58309->58310 58310->58310 58311 a42810 4 API calls 58310->58311 58312 a5456a 58311->58312 58313 a42810 4 API calls 58312->58313 58314 a545a2 58313->58314 58315 a4c3e0 4 API calls 58314->58315 58356 b023f9 58355->58356 58358 b022f5 58355->58358 58356->57793 58358->58356 58909 b01b90 58358->58909 58359 b023da 58359->57793 58360 b023a9 58363 b0237c 58369 b1bed2 GetSystemTimePreciseAsFileTime 58368->58369 58373 a54935 58369->58373 58370 a54a83 59088 b1bb7b 8 API calls std::locale::_Setgloballocale 58370->59088 58371 a5499c __Mtx_unlock 58376 b19a90 3 API calls 58371->58376 58373->58370 58373->58371 58375 a549b7 58373->58375 58377 b19a90 3 API calls 58375->58377 58378 a549b0 58376->58378 58379 a549be 58377->58379 58378->57793 59075 b2645e 58379->59075 58386->57793 58387->57793 58388->57793 58393 aa77ea 58390->58393 58391 b1c950 std::_Facet_Register 4 API calls 58392 aa7820 58391->58392 58394 aa7909 58392->58394 58395 aa7873 58392->58395 58401 a62f52 58392->58401 58393->58391 58397 a42b90 4 API calls 58394->58397 58402 aa91a0 4 API calls 2 library calls 58395->58402 58399 aa790e 58397->58399 58398 aa7879 58400 aa3560 4 API calls 58398->58400 58398->58401 58400->58398 58401->57752 58402->58398 58910 b01bad 58909->58910 58911 acb220 3 API calls 58910->58911 58913 b01be1 __fread_nolock 58910->58913 58920 b01bb2 58910->58920 58911->58913 58912 b022a9 58912->58359 58912->58360 58912->58363 58946 adda00 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap 58912->58946 58915 b01da6 58913->58915 58917 b01c6f 58913->58917 58913->58920 58914 acd5c0 3 API calls 58914->58912 58948 b18b00 58915->58948 58918 b01c74 58917->58918 58922 b01cb4 58917->58922 58919 acd5c0 3 API calls 58918->58919 58920->58912 58920->58914 58946->58363 58949 b18b36 58948->58949 59076 b26476 59075->59076 59077 b2646c 59075->59077 59158->57838 59159->57849 59160->57849 59161->57849 59239->57929 59240->57867 59241->57884 59615->58027 59616->58030 59618 b2a50a ___std_exception_copy 59617->59618 59634 b270fa 59618->59634 59620 b2a524 59621 b21b9c ___std_exception_copy 3 API calls 59620->59621 59622 b2a533 59621->59622 59622->58030 59624 aacbe1 59623->59624 59625 aacc2a 59624->59625 59626 aacccf 59624->59626 59630 aacc44 59624->59630 59628 b1c950 std::_Facet_Register 4 API calls 59625->59628 59665 a47d60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59626->59665 59628->59630 59629 aaccd4 59630->58030 59631->58030 59632->58030 59650 b26079 59634->59650 59636 b27155 59639 b2717a 59636->59639 59658 b273d0 4 API calls 2 library calls 59636->59658 59637 b27122 59657 b21de3 ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy __Getctype 59637->59657 59638 b2710d 59638->59636 59638->59637 59648 b2713d 59638->59648 59659 b26094 4 API calls 2 library calls 59639->59659 59644 b2718f 59645 b271b8 59644->59645 59660 b26094 4 API calls 2 library calls 59644->59660 59648->59620 59651 b26091 59650->59651 59652 b2607e 59650->59652 59651->59638 59663 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 59652->59663 59654 b26083 59664 b21e60 ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 59654->59664 59656 b2608e 59656->59638 59657->59648 59658->59639 59659->59644 59660->59644 59663->59654 59664->59656 59665->59629 59667 aa5770 4 API calls 59666->59667 59668 aa9826 59667->59668 59668->58128 59669->58128 59670->58057 59671->58076 59672->58086 59730 aa5a60 4 API calls 59729->59730 59731 a70400 59730->59731 59732 a4b890 9 API calls 59731->59732 59733 a7040b 59732->59733 59780 b1b75e 4 API calls 6 library calls 59733->59780 59735 a70483 59781 aa8e30 5 API calls 5 library calls 59735->59781 59737 a7049b 59782 aaa9c0 5 API calls std::_Facet_Register 59737->59782 59739 a704cd 59769->58238 59772->58255 59773->58255 59774->58255 59776->58255 59780->59735 59781->59737 59782->59739 59791->58287 59792->58287 59793 a94ef0 60088 a94f33 __Mtx_unlock 59793->60088 59794 a94f4b 59795 aa97b0 4 API calls 59794->59795 59797 a97064 59795->59797 59796 aa97b0 4 API calls 59796->60088 59798 a4bf40 10 API calls 59797->59798 59799 a9707d 59798->59799 59800 a9708e CreateDirectoryA 59799->59800 59802 a9709d 59799->59802 59800->59802 59803 a97c93 59800->59803 59801 a97c78 59801->59803 59806 a4c000 13 API calls 59801->59806 59802->59801 59804 aa9e10 4 API calls 59802->59804 59805 a42660 3 API calls 59803->59805 59991 a970c5 __Mtx_unlock 59804->59991 59807 a97ca1 59805->59807 59806->59803 59808 a97c69 60147 a5c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 59808->60147 59811 a97f07 59812 b21e70 3 API calls 59811->59812 59814 a97f0c 59812->59814 59813 a4c000 13 API calls 59813->60088 60152 b1bb7b 8 API calls std::locale::_Setgloballocale 59814->60152 59816 aaba40 ExitProcess RtlAllocateHeap RtlFreeHeap 59816->60088 59817 a97f12 60153 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59817->60153 59819 a97f17 59820 b21e70 3 API calls 59819->59820 59823 a97f1c 59820->59823 59821 aa9e10 4 API calls 59821->59991 59822 aa9e10 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59822->60088 59824 a97ff8 59823->59824 59825 a9a0d7 59823->59825 59826 aad420 4 API calls 59824->59826 60154 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59825->60154 59830 a98021 59826->59830 59827 b1c950 std::_Facet_Register 4 API calls 59827->60088 59828 aaba40 3 API calls 59828->59991 59832 b1bed2 GetSystemTimePreciseAsFileTime 59830->59832 59831 a9a0dc 60155 b1bb7b 8 API calls std::locale::_Setgloballocale 59831->60155 59835 a9804e 59832->59835 59833 ab97b0 4 API calls 59833->60088 59835->59831 59837 a98059 59835->59837 59836 a9a0e2 60156 b1bb7b 8 API calls std::locale::_Setgloballocale 59836->60156 59839 a98079 __Mtx_unlock 59837->59839 59847 a9806d GetFileAttributesA 59837->59847 59844 b1bed2 GetSystemTimePreciseAsFileTime 59839->59844 59857 a98093 __Mtx_unlock 59839->59857 59842 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59842->59991 59848 a980cd 59844->59848 59846 a97eee Concurrency::cancel_current_task 60151 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59846->60151 59847->59839 59847->59857 59848->59836 59852 a980d8 CreateDirectoryA 59848->59852 59850 aa9870 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59850->60088 59852->59857 59856 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59856->60088 59870 b1c950 std::_Facet_Register 4 API calls 59857->59870 59884 a98f43 59857->59884 59902 a98f1b 59857->59902 59859 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59859->59991 59861 a97e3a Concurrency::cancel_current_task 60148 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59861->60148 59862 aa57e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59862->59991 59865 a4c000 13 API calls 59865->59884 59866 b1bed2 GetSystemTimePreciseAsFileTime 59866->59991 59867 a42700 4 API calls 59867->59991 59868 a97e53 60149 b1bb7b 8 API calls std::locale::_Setgloballocale 59868->60149 59869 a42700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59869->60088 59874 a9814e 59870->59874 59872 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59872->60088 59879 ab97b0 4 API calls 59874->59879 59876 aa9870 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59876->59991 59877 a4bf40 10 API calls 59877->60088 59878 a97e59 60150 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59878->60150 60095 a98177 __Mtx_unlock 59879->60095 59883 b22a20 3 API calls 59883->59991 59889 a98fd8 59884->59889 59890 a9a123 59884->59890 59885 b22a20 ExitProcess RtlAllocateHeap RtlFreeHeap 59885->60088 59886 a97e5e 59907 a42700 4 API calls 59886->59907 59888 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59888->60088 59896 aad420 4 API calls 59889->59896 60165 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59890->60165 59891 a4bf40 10 API calls 59891->59991 59892 b1bed2 GetSystemTimePreciseAsFileTime 59892->60088 59901 a98ffe 59896->59901 59900 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59900->59991 59902->59865 59902->59884 59911 a97e6f 59907->59911 59917 aa98d0 4 API calls 59911->59917 59912 aad230 4 API calls 59912->59991 59913 aa9810 4 API calls 59913->60088 59921 a97e84 59917->59921 59923 a48920 4 API calls 59921->59923 59937 a97e9c Concurrency::cancel_current_task 59923->59937 59928 aad230 4 API calls 59928->60088 59930 b262a8 7 API calls 59930->60088 59931 aa26a0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59931->59991 59935 a4bfc0 10 API calls 59935->60088 59942 a42700 4 API calls 59937->59942 59939 b262a8 7 API calls 59939->59991 59941 aa27b0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59941->59991 59946 a97ec1 59942->59946 59943 aa57e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59943->60088 59949 aa98d0 4 API calls 59946->59949 59954 a97ed6 59949->59954 59950 aa26a0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59950->60088 59961 a48920 4 API calls 59954->59961 59956 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 59956->60088 59959 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59959->59991 59961->59846 59962 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 59962->59991 59966 aa27b0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59966->60088 59989 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59989->59991 59990 a42be0 6 API calls 59990->59991 59991->59808 59991->59811 59991->59814 59991->59817 59991->59819 59991->59821 59991->59828 59991->59842 59991->59846 59991->59859 59991->59862 59991->59866 59991->59867 59991->59876 59991->59883 59991->59891 59991->59900 59991->59912 59991->59931 59991->59939 59991->59941 59991->59959 59991->59962 59991->59989 59991->59990 59994 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59994->60088 59997 ab0420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 59997->60088 60040 a97daa 60050 a42700 4 API calls 60040->60050 60048 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60048->60088 60053 a97dbb 60050->60053 60055 aa98d0 4 API calls 60053->60055 60059 a97dd0 60055->60059 60063 a48920 4 API calls 60059->60063 60068 a97de8 Concurrency::cancel_current_task 60063->60068 60072 a42700 4 API calls 60068->60072 60073 a97e0d 60072->60073 60076 aa98d0 4 API calls 60073->60076 60077 a97e22 60076->60077 60080 a48920 4 API calls 60077->60080 60080->59861 60088->59794 60088->59796 60088->59811 60088->59813 60088->59816 60088->59822 60088->59827 60088->59833 60088->59850 60088->59856 60088->59861 60088->59868 60088->59869 60088->59872 60088->59877 60088->59878 60088->59885 60088->59886 60088->59888 60088->59892 60088->59913 60088->59928 60088->59930 60088->59935 60088->59937 60088->59943 60088->59950 60088->59956 60088->59966 60088->59994 60088->59997 60088->60040 60088->60048 60088->60068 60091 a42be0 6 API calls 60088->60091 60143 aa9a30 60088->60143 60146 a5c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 60088->60146 60091->60088 60144 aad230 4 API calls 60143->60144 60145 aa9a48 60144->60145 60145->60088 60146->60088 60147->59801 60195 a9cc70 14 API calls 54224 a9e8c0 54225 a9e90d 54224->54225 54226 a9ea55 54224->54226 54225->54225 54227 a9e95a 54225->54227 54228 a9ec23 54225->54228 54231 a9ec32 54226->54231 54232 a9eaa6 54226->54232 54229 aad420 4 API calls 54227->54229 54253 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54228->54253 54235 a9e980 54229->54235 54254 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54231->54254 54233 aad420 4 API calls 54232->54233 54237 a9eacc 54233->54237 54239 a9e9be 54235->54239 54251 ab0cc0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54235->54251 54236 a9ec28 54240 b21e70 3 API calls 54236->54240 54242 aa5a60 4 API calls 54237->54242 54238 a9eade 54243 b21e70 3 API calls 54238->54243 54250 a9eb10 54238->54250 54252 a4c7d0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap ___std_exception_destroy ___std_exception_copy 54239->54252 54241 a9ec2d 54240->54241 54245 b21e70 3 API calls 54241->54245 54242->54238 54246 a9ec3c 54243->54246 54245->54231 54248 a9e9ea 54248->54236 54249 a9ea1d 54248->54249 54249->54226 54249->54241 54251->54239 54252->54248 54255 a9cdc0 54382 a824f0 54255->54382 54257 a9ce21 54257->54257 54258 a9ce78 54257->54258 54259 a9e816 54257->54259 54261 aad420 4 API calls 54258->54261 55889 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54259->55889 54263 a9cea1 CreateDirectoryA 54261->54263 54262 a9e81b 55890 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54262->55890 54271 a9da4f 54263->54271 54284 a9cecc std::_Locinfo::_Locinfo_ctor __Mtx_unlock 54263->54284 54265 a9e820 54266 b21e70 3 API calls 54265->54266 54270 a9e825 54266->54270 54267 a9e6d9 54268 a9da21 54269 aa5a60 4 API calls 54268->54269 54280 a9da32 54269->54280 55891 b1bb7b 8 API calls std::locale::_Setgloballocale 54270->55891 54273 a9e69f 54271->54273 54276 a9dab8 54271->54276 54277 a9e860 54271->54277 54273->54267 54275 b21e70 3 API calls 54273->54275 54274 a9e82b 55892 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54274->55892 54298 a9e8b4 54275->54298 54279 aad420 4 API calls 54276->54279 55898 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54277->55898 54283 a9dae1 CreateDirectoryA 54279->54283 54280->54271 54965 a4c000 54280->54965 54281 a9e830 54286 b21e70 3 API calls 54281->54286 54293 a9e66c 54283->54293 54380 a9db06 std::_Locinfo::_Locinfo_ctor __Mtx_unlock 54283->54380 54284->54262 54284->54265 54284->54268 54284->54270 54284->54274 54284->54281 54288 a9e835 54284->54288 54296 a9e83b 54284->54296 54301 a9e840 54284->54301 54315 a9e845 54284->54315 54327 aa57e0 4 API calls 54284->54327 54332 a9e84b 54284->54332 54341 a9e850 54284->54341 54347 a9e855 54284->54347 54352 a9e85b 54284->54352 54368 aab810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54284->54368 54369 a42810 4 API calls 54284->54369 54370 b1bed2 GetSystemTimePreciseAsFileTime 54284->54370 54371 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54284->54371 54372 aad230 4 API calls 54284->54372 54377 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54284->54377 55716 aa5640 4 API calls 3 library calls 54284->55716 55717 a4f000 54284->55717 54286->54288 54287 a9e865 55899 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54287->55899 55893 b1bb7b 8 API calls std::locale::_Setgloballocale 54288->55893 54290 a9e86a 54292 b21e70 3 API calls 54290->54292 54297 a9e86f 54292->54297 54293->54273 54305 b21e70 3 API calls 54293->54305 54294 a9e63e 54299 aa5a60 4 API calls 54294->54299 54295 a9ea55 54312 a9ec32 54295->54312 54313 a9eaa6 54295->54313 55894 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54296->55894 55900 b1bb7b 8 API calls std::locale::_Setgloballocale 54297->55900 54298->54295 54303 a9e95a 54298->54303 54304 a9ec23 54298->54304 54306 a9e64f 54299->54306 54307 b21e70 3 API calls 54301->54307 54309 aad420 4 API calls 54303->54309 55909 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54304->55909 54305->54273 54990 a51370 54306->54990 54307->54315 54308 a9e875 55901 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54308->55901 54318 a9e980 54309->54318 55910 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54312->55910 54314 aad420 4 API calls 54313->54314 54321 a9eacc 54314->54321 55895 b1bb7b 8 API calls std::locale::_Setgloballocale 54315->55895 54325 a9e9be 54318->54325 55907 ab0cc0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54318->55907 54319 a9ec28 54328 b21e70 3 API calls 54319->54328 54331 aa5a60 4 API calls 54321->54331 54323 a9eade 54333 b21e70 3 API calls 54323->54333 54349 a9eb10 54323->54349 54324 a9e87a 54334 b21e70 3 API calls 54324->54334 55908 a4c7d0 RtlAllocateHeap RtlAllocateHeap RtlFreeHeap ___std_exception_destroy ___std_exception_copy 54325->55908 54326 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54326->54380 54327->54284 54329 a9ec2d 54328->54329 54336 b21e70 3 API calls 54329->54336 54331->54323 54337 b21e70 3 API calls 54332->54337 54338 a9ec3c 54333->54338 54339 a9e87f 54334->54339 54336->54312 54337->54341 55902 b1bb7b 8 API calls std::locale::_Setgloballocale 54339->55902 55896 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54341->55896 54343 a9e9ea 54343->54319 54346 a9ea1d 54343->54346 54345 a9e885 55903 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54345->55903 54346->54295 54346->54329 55897 b1bb7b 8 API calls std::locale::_Setgloballocale 54347->55897 54351 a9e88a 54353 b21e70 3 API calls 54351->54353 54354 b21e70 3 API calls 54352->54354 54355 a9e88f 54353->54355 54354->54277 55904 b1bb7b 8 API calls std::locale::_Setgloballocale 54355->55904 54356 aa57e0 4 API calls 54356->54380 54358 a9e895 54359 b21e70 3 API calls 54358->54359 54360 a9e89a 54359->54360 55905 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54360->55905 54362 a9e89f 55906 b1bb7b 8 API calls std::locale::_Setgloballocale 54362->55906 54364 a9e8a5 54365 b21e70 3 API calls 54364->54365 54365->54293 54366 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54366->54380 54367 b1bed2 GetSystemTimePreciseAsFileTime 54367->54380 54368->54284 54369->54284 54370->54284 54371->54284 54372->54284 54373 a42810 4 API calls 54373->54380 54374 aab810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54374->54380 54376 aad230 4 API calls 54376->54380 54377->54284 54380->54287 54380->54290 54380->54294 54380->54297 54380->54308 54380->54324 54380->54326 54380->54339 54380->54345 54380->54351 54380->54355 54380->54356 54380->54358 54380->54360 54380->54362 54380->54364 54380->54366 54380->54367 54380->54373 54380->54374 54380->54376 54381 a4f000 14 API calls 54380->54381 55888 aa5640 4 API calls 3 library calls 54380->55888 54381->54380 54383 a82512 54382->54383 54385 a828c0 54383->54385 54386 aa97b0 4 API calls 54383->54386 54384 a851bf 54384->54257 54387 aa97b0 4 API calls 54385->54387 54389 a83dde 54385->54389 54388 a8256d 54386->54388 54390 a828f5 54387->54390 54393 a8257e CreateDirectoryA 54388->54393 54391 aa97b0 4 API calls 54389->54391 54392 a84f96 54389->54392 54396 a8290a CreateDirectoryA 54390->54396 54394 a83e2f 54391->54394 54392->54384 54395 aa97b0 4 API calls 54392->54395 54397 a8258a 54393->54397 54398 a828ae 54393->54398 54402 a83e44 CreateDirectoryA 54394->54402 54399 a84fc9 54395->54399 54400 a83dcc 54396->54400 54401 a82917 54396->54401 54409 aa97b0 4 API calls 54397->54409 54403 a42660 3 API calls 54398->54403 54406 a84fde CreateDirectoryA 54399->54406 54407 a42660 3 API calls 54400->54407 54412 aa97b0 4 API calls 54401->54412 54404 a83e51 54402->54404 54405 a84f84 54402->54405 54403->54385 54416 aa97b0 4 API calls 54404->54416 54408 a42660 3 API calls 54405->54408 54410 a84feb 54406->54410 54411 a851b4 54406->54411 54407->54389 54408->54392 54413 a825c8 54409->54413 54419 aa97b0 4 API calls 54410->54419 54414 a42660 3 API calls 54411->54414 54415 a82956 54412->54415 54417 a825db CreateDirectoryA 54413->54417 54414->54384 54421 a8296a CreateDirectoryA 54415->54421 54418 a83e8c 54416->54418 54422 a825ec __fread_nolock 54417->54422 54423 a826e7 54417->54423 54426 a83e9e CreateDirectoryA 54418->54426 54420 a85027 54419->54420 54427 a85039 CreateDirectoryA 54420->54427 54424 a82aca 54421->54424 54425 a82975 54421->54425 54428 a825fe SHGetFolderPathA 54422->54428 54432 aa97b0 4 API calls 54423->54432 54435 aa97b0 4 API calls 54424->54435 54437 a42700 4 API calls 54425->54437 54429 a83eab 54426->54429 54430 a83fce 54426->54430 54431 a85193 54427->54431 54461 a85046 54427->54461 54433 a82638 54428->54433 54438 a42700 4 API calls 54429->54438 54441 aa97b0 4 API calls 54430->54441 54434 a4c000 13 API calls 54431->54434 54439 a851a6 54431->54439 54436 a82719 54432->54436 54442 a42700 4 API calls 54433->54442 54434->54439 54440 a82b05 54435->54440 54444 a8272d CreateDirectoryA 54436->54444 54451 a829ab 54437->54451 54459 a83efc 54438->54459 54447 a42660 3 API calls 54439->54447 54448 a82b19 CreateDirectoryA 54440->54448 54445 a8400e 54441->54445 54443 a82644 54442->54443 54446 aa98d0 4 API calls 54443->54446 54449 a82738 __fread_nolock 54444->54449 54450 a82880 54444->54450 54456 a84020 CreateDirectoryA 54445->54456 54452 a8265a 54446->54452 54447->54411 54454 a82f33 54448->54454 54455 a82b24 54448->54455 54462 a8274b SHGetFolderPathA 54449->54462 54453 a82895 54450->54453 54458 a4c000 13 API calls 54450->54458 54466 aa98d0 4 API calls 54451->54466 54457 a42660 3 API calls 54452->54457 54460 a42660 3 API calls 54453->54460 54473 aa97b0 4 API calls 54454->54473 54474 a42700 4 API calls 54455->54474 54463 a84138 54456->54463 54464 a8402d 54456->54464 54467 a8266c 54457->54467 54458->54453 54471 aa98d0 4 API calls 54459->54471 54468 a828a3 54460->54468 54469 a42810 4 API calls 54461->54469 54465 a8278b 54462->54465 54480 aa97b0 4 API calls 54463->54480 54476 a42700 4 API calls 54464->54476 54475 a42700 4 API calls 54465->54475 54470 a829fa 54466->54470 55911 a4bf40 54467->55911 54472 a42660 3 API calls 54468->54472 54490 a850bc 54469->54490 54477 a42660 3 API calls 54470->54477 54478 a83f3f 54471->54478 54472->54398 54479 a82f6e 54473->54479 54496 a82b65 54474->54496 54481 a82797 54475->54481 54502 a84066 54476->54502 54482 a82a0c 54477->54482 54484 a42660 3 API calls 54478->54484 54489 a82f82 CreateDirectoryA 54479->54489 54485 a84162 54480->54485 54486 aa98d0 4 API calls 54481->54486 54503 a42700 4 API calls 54482->54503 54488 a83f51 54484->54488 54491 a84174 CreateDirectoryA 54485->54491 54492 a827ad 54486->54492 54511 a4bf40 10 API calls 54488->54511 54494 a82f8d 54489->54494 54495 a83100 54489->54495 54497 aa98d0 4 API calls 54490->54497 54498 a8428e 54491->54498 54499 a84181 54491->54499 54501 a42660 3 API calls 54492->54501 54519 a42700 4 API calls 54494->54519 54514 aa97b0 4 API calls 54495->54514 54506 aa98d0 4 API calls 54496->54506 54505 a85109 54497->54505 54528 aa97b0 4 API calls 54498->54528 54522 a42700 4 API calls 54499->54522 54508 a827bf 54501->54508 54515 aa98d0 4 API calls 54502->54515 54509 a82a24 54503->54509 54512 a42660 3 API calls 54505->54512 54513 a82ba8 54506->54513 54529 a42700 4 API calls 54508->54529 54516 a4beb0 7 API calls 54509->54516 54518 a83f63 54511->54518 54520 a8511b 54512->54520 54521 a42660 3 API calls 54513->54521 54524 a83145 54514->54524 54525 a840a9 54515->54525 54548 a82a29 54516->54548 54527 a83fa0 54518->54527 54536 aa5a60 4 API calls 54518->54536 54544 a82fe2 54519->54544 54550 a4bf40 10 API calls 54520->54550 54534 a82bba 54521->54534 54559 a841bc 54522->54559 54538 a83159 CreateDirectoryA 54524->54538 54535 a42660 3 API calls 54525->54535 54530 a4c000 13 API calls 54527->54530 54540 a83fa7 54527->54540 54533 a842cc 54528->54533 54539 a827d7 54529->54539 54530->54540 54531 a82a9f 54542 a4c000 13 API calls 54531->54542 54551 a82aa3 54531->54551 54549 a842de CreateDirectoryA 54533->54549 54558 a42700 4 API calls 54534->54558 54541 a840bb 54535->54541 54537 a83f7f 54536->54537 54543 aa5a60 4 API calls 54537->54543 54545 a832bb 54538->54545 54546 a83164 54538->54546 54553 a42660 3 API calls 54540->54553 54566 a4bf40 10 API calls 54541->54566 54542->54551 54552 a83f94 54543->54552 54562 aa98d0 4 API calls 54544->54562 54570 aa97b0 4 API calls 54545->54570 54569 a42700 4 API calls 54546->54569 54548->54531 54554 aa97b0 4 API calls 54548->54554 54555 a849b8 54549->54555 54556 a842eb 54549->54556 54557 a8512d 54550->54557 54560 a42660 3 API calls 54551->54560 54553->54430 54590 a82a71 54554->54590 54564 a85167 54557->54564 54571 aa5a60 4 API calls 54557->54571 54565 a82bd2 54558->54565 54573 aa98d0 4 API calls 54559->54573 54560->54424 54567 a83025 54562->54567 54568 a4c000 13 API calls 54564->54568 54578 a8516e 54564->54578 54572 a4beb0 7 API calls 54565->54572 54575 a840cd 54566->54575 54577 a42660 3 API calls 54567->54577 54568->54578 54583 a85147 54571->54583 54584 a841ff 54573->54584 54596 a42660 3 API calls 54578->54596 54592 aa5a60 4 API calls 54583->54592 54622 a42660 3 API calls 54590->54622 54596->54431 54622->54531 54966 b1bed2 GetSystemTimePreciseAsFileTime 54965->54966 54967 a4c033 54966->54967 54968 a4c3c2 54967->54968 54969 a4c03e 54967->54969 56255 b1bb7b 8 API calls std::locale::_Setgloballocale 54968->56255 54971 a4c3c8 54969->54971 54973 aad420 4 API calls 54969->54973 56256 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 54971->56256 54974 a4c09c FindFirstFileA 54973->54974 54979 a4c2e6 54974->54979 54983 a4c10c 54974->54983 54975 b21e70 3 API calls 54977 a4c3d2 54975->54977 54978 a4c387 __Mtx_unlock 54978->54271 54979->54975 54979->54978 54980 aad420 4 API calls 54980->54983 54981 aa5770 4 API calls 54981->54983 54982 aa58e0 3 API calls 54982->54983 54983->54971 54983->54979 54983->54980 54983->54981 54983->54982 54984 a4c000 9 API calls 54983->54984 54985 a4c2a1 FindNextFileA 54983->54985 54984->54983 54985->54983 54986 a4c2b8 54985->54986 54986->54979 54987 a4c2d6 SetFileAttributesA 54986->54987 54987->54979 56257 b1ebb0 54990->56257 54993 b1ebb0 __fread_nolock 54994 a513da SHGetFolderPathA 54993->54994 54995 a51421 54994->54995 55716->54284 55718 a4f086 55717->55718 55719 a4f604 55718->55719 55721 aad420 4 API calls 55718->55721 57119 a42040 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 55719->57119 55772 a4f0d9 __Mtx_unlock 55721->55772 55722 a4f609 57120 b1bb7b 8 API calls std::locale::_Setgloballocale 55722->57120 55724 b21e70 3 API calls 55727 a4f614 __fread_nolock 55724->55727 55725 a4f485 55725->55724 55726 a4f5e8 55725->55726 55726->54284 55728 a42810 4 API calls 55727->55728 55729 a4f6e9 55728->55729 55730 aa98d0 4 API calls 55729->55730 55731 a4f6ff 55730->55731 55733 a4f730 55731->55733 55736 a50455 55731->55736 55732 aad420 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 55732->55772 55735 b1bed2 GetSystemTimePreciseAsFileTime 55733->55735 55734 aa5770 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 55734->55772 55739 b21e70 3 API calls 55736->55739 55738 aa58e0 ExitProcess RtlAllocateHeap RtlFreeHeap 55738->55772 55747 b1bed2 GetSystemTimePreciseAsFileTime 55747->55772 55770 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 55770->55772 55772->55719 55772->55722 55772->55725 55772->55732 55772->55734 55772->55738 55772->55747 55772->55770 55774 a4f000 13 API calls 55772->55774 55774->55772 55888->54380 55907->54325 55908->54343 55956 b1bed2 55911->55956 55914 a4bfae 55915 a4bf59 55960 b1bcac 55956->55960 55958 a4bf52 55958->55914 55958->55915 55961 b1bd0e 55960->55961 55963 b1bcd4 _ValidateLocalCookies 55960->55963 55961->55963 55966 b1c351 GetSystemTimePreciseAsFileTime __aulldiv __aullrem __Xtime_get_ticks 55961->55966 55963->55958 55964 b1bd64 __Xtime_diff_to_millis2 55964->55963 55966->55964 56258 a513ad SHGetFolderPathA 56257->56258 56258->54993 57618 aa8ac0 57619 aa8ae7 57618->57619 57620 aa8ad7 57618->57620 57620->57619 57621 b21e70 3 API calls 57620->57621 57622 aa8afc 57621->57622 57623 aa8b98 57622->57623 57630 b1bc81 57622->57630 57627 aa8b42 57641 aaab20 5 API calls 6 library calls 57627->57641 57629 aa8b62 57631 b1bbdd 57630->57631 57632 b1bc36 57631->57632 57633 aa8b31 57631->57633 57636 b22a15 3 API calls 57631->57636 57638 b1bc3d 57632->57638 57642 b22a15 57632->57642 57633->57623 57640 aa7a40 ExitProcess RtlAllocateHeap RtlFreeHeap 57633->57640 57635 b1bc5a 57635->57633 57656 b267f6 57635->57656 57636->57632 57638->57633 57639 b262a8 7 API calls 57638->57639 57639->57633 57640->57627 57641->57629 57644 b2295e __fread_nolock 57642->57644 57643 b22971 57662 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 57643->57662 57644->57643 57647 b22991 57644->57647 57646 b22976 57663 b21e60 ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy 57646->57663 57649 b229a3 57647->57649 57650 b22996 57647->57650 57651 b33d48 2 API calls 57649->57651 57664 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 57650->57664 57653 b229ac 57651->57653 57654 b22981 57653->57654 57665 b2a8ff RtlAllocateHeap RtlFreeHeap __dosmaperr 57653->57665 57654->57635 57657 b26809 ___std_exception_copy 57656->57657 57666 b2654d 57657->57666 57659 b2681e 57660 b21b9c ___std_exception_copy 3 API calls 57659->57660 57661 b2682b 57660->57661 57661->57638 57662->57646 57663->57654 57664->57654 57665->57654 57668 b26559 __fread_nolock 57666->57668 57667 b2655f 57682 b21de3 ExitProcess RtlAllocateHeap RtlFreeHeap ___std_exception_copy __Getctype 57667->57682 57668->57667 57670 b265a2 __fread_nolock 57668->57670 57673 b266d0 57670->57673 57672 b2657a 57672->57659 57674 b266e3 57673->57674 57675 b266f6 57673->57675 57674->57672 57683 b265f7 57675->57683 57677 b26719 57678 b22c91 6 API calls 57677->57678 57681 b267a7 57677->57681 57681->57672 57682->57672 57684 b26660 57683->57684 57685 b26608 57683->57685 57684->57677 57685->57684 57687 b2b7fd 4 API calls 2 library calls 57685->57687 57687->57684 57688 aa9040 57689 aa9083 57688->57689 57690 aa904a 57688->57690 57690->57689 57691 b21e70 3 API calls 57690->57691 57692 aa90ab 57691->57692 57697 aa91a0 4 API calls 2 library calls 57692->57697 57694 aa90cb 57698 aa9120 ExitProcess RtlAllocateHeap RtlFreeHeap 57694->57698 57696 aa90ec 57697->57694 57698->57696 60570 a93550 60571 a93590 60570->60571 60572 aa97b0 4 API calls 60571->60572 60573 a942bb 60571->60573 60575 a94ace 60571->60575 60574 a935f9 60572->60574 60576 aa97b0 4 API calls 60573->60576 60579 a4bf40 10 API calls 60574->60579 60581 aa97b0 4 API calls 60575->60581 60584 a94c64 60575->60584 60578 a94302 60576->60578 60577 a94ddc 60697 aa2210 ExitProcess RtlAllocateHeap RtlFreeHeap 60577->60697 60585 b22a20 3 API calls 60578->60585 60587 a93612 60579->60587 60583 a94b4c 60581->60583 60582 a94dea 60593 b22a20 3 API calls 60583->60593 60584->60577 60588 aa97b0 4 API calls 60584->60588 60586 a94316 60585->60586 60589 a42660 3 API calls 60586->60589 60590 a9362a 60587->60590 60592 a4bfc0 10 API calls 60587->60592 60591 a94cf1 60588->60591 60599 a94329 60589->60599 60594 aa9e10 4 API calls 60590->60594 60596 a942a9 60590->60596 60602 a93c9c 60590->60602 60598 b22a20 3 API calls 60591->60598 60592->60590 60595 a94b60 60593->60595 60682 a9365a 60594->60682 60597 a42660 3 API calls 60595->60597 60600 a42660 3 API calls 60596->60600 60609 a94b73 60597->60609 60603 a94d05 60598->60603 60599->60575 60604 a42be0 6 API calls 60599->60604 60600->60573 60601 a94288 60601->60596 60608 a4c000 13 API calls 60601->60608 60602->60601 60605 aa9e10 4 API calls 60602->60605 60607 a42660 3 API calls 60603->60607 60612 a94342 60604->60612 60652 a93cc8 60605->60652 60606 a93c8d 60688 a5c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 60606->60688 60614 a94d18 60607->60614 60608->60596 60609->60584 60611 a42be0 6 API calls 60609->60611 60635 a94b8c 60611->60635 60615 aa9e10 4 API calls 60612->60615 60621 a946f8 60612->60621 60613 a94279 60691 a5c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 60613->60691 60614->60577 60617 a42be0 6 API calls 60614->60617 60653 a94368 60615->60653 60616 a94c5e 60619 b262a8 7 API calls 60616->60619 60631 a94d31 60617->60631 60619->60584 60620 a94ac8 60622 b262a8 7 API calls 60620->60622 60621->60620 60694 aacce0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Facet_Register 60621->60694 60622->60575 60624 a94dd6 60627 b262a8 7 API calls 60624->60627 60625 a9471f 60626 ab97b0 4 API calls 60625->60626 60651 a9473b 60626->60651 60627->60577 60628 a946e9 60693 a5c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 60628->60693 60631->60624 60637 a42be0 6 API calls 60631->60637 60632 aa27b0 4 API calls 60632->60682 60633 a94ab9 60696 a5c2b0 ExitProcess RtlAllocateHeap RtlFreeHeap 60633->60696 60635->60616 60639 a42be0 6 API calls 60635->60639 60636 a42700 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60636->60682 60637->60631 60639->60635 60640 aa27b0 4 API calls 60640->60652 60642 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60642->60652 60643 aa27b0 4 API calls 60643->60653 60645 aa27b0 4 API calls 60645->60651 60646 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60646->60682 60647 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60647->60653 60648 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60648->60682 60649 a42810 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60649->60651 60650 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60650->60652 60651->60633 60651->60645 60651->60649 60657 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60651->60657 60659 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60651->60659 60667 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 60651->60667 60673 a42be0 6 API calls 60651->60673 60695 aa6f90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 60651->60695 60652->60613 60652->60640 60652->60642 60652->60650 60660 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60652->60660 60662 aa9870 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60652->60662 60663 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 60652->60663 60671 a4bfc0 10 API calls 60652->60671 60676 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60652->60676 60677 a4beb0 7 API calls 60652->60677 60679 a4bf40 10 API calls 60652->60679 60680 b22a20 ExitProcess RtlAllocateHeap RtlFreeHeap 60652->60680 60681 a42be0 6 API calls 60652->60681 60684 b262a8 7 API calls 60652->60684 60689 aa6f90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 60652->60689 60690 aa8390 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Locinfo::_Locinfo_ctor 60652->60690 60653->60628 60653->60643 60653->60647 60656 aa9b20 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60653->60656 60665 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 60653->60665 60666 ab0ac0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60653->60666 60672 a42be0 6 API calls 60653->60672 60692 aa6f90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 60653->60692 60654 aa9870 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60654->60682 60655 a42660 ExitProcess RtlAllocateHeap RtlFreeHeap 60655->60682 60656->60653 60657->60651 60658 a4bf40 10 API calls 60658->60682 60659->60651 60660->60652 60661 aa5a60 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60661->60682 60662->60652 60663->60652 60664 a4bfc0 10 API calls 60664->60682 60665->60653 60666->60653 60667->60651 60670 a4beb0 7 API calls 60670->60682 60671->60652 60672->60653 60673->60651 60674 b22a20 ExitProcess RtlAllocateHeap RtlFreeHeap 60674->60682 60676->60652 60677->60652 60678 a42be0 6 API calls 60678->60682 60679->60652 60680->60652 60681->60652 60682->60606 60682->60632 60682->60636 60682->60646 60682->60648 60682->60654 60682->60655 60682->60658 60682->60661 60682->60664 60682->60670 60682->60674 60682->60678 60683 b262a8 7 API calls 60682->60683 60685 aa6f90 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap Concurrency::cancel_current_task 60682->60685 60686 a4c6e0 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap 60682->60686 60687 aa8390 RtlAllocateHeap ExitProcess RtlAllocateHeap RtlFreeHeap std::_Locinfo::_Locinfo_ctor 60682->60687 60683->60682 60684->60652 60685->60682 60686->60682 60687->60682 60688->60602 60689->60652 60690->60652 60691->60601 60692->60653 60693->60621 60694->60625 60695->60651 60696->60620 60697->60582

                                                                                                                                                                      Executed Functions

                                                                                                                                                                      Function 00A97F20 Relevance: 61.0, APIs: 31, Strings: 1, Instructions: 5012COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$AttributesCreateDirectoryFile
                                                                                                                                                                      • String ID: Y
                                                                                                                                                                      • API String ID: 3883471643-4136946213
                                                                                                                                                                      • Opcode ID: dc4656c2c80b02218b3dfa57b4658b977e5413a1bfb17fe22f55e236fb5a626f
                                                                                                                                                                      • Instruction ID: 060f35e1ac6486d81a685c070ff1331bf230cfea0ce368656b1475dae9b58eac
                                                                                                                                                                      • Opcode Fuzzy Hash: dc4656c2c80b02218b3dfa57b4658b977e5413a1bfb17fe22f55e236fb5a626f
                                                                                                                                                                      • Instruction Fuzzy Hash: 39A3E070A002588FEF29CB68CD49BEEBBF5AF46304F1482D9D049A7292D7749E85CF51
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A822B0 Relevance: 53.5, APIs: 22, Strings: 7, Instructions: 2735COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A82580
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A825DC
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A82F83
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A8315A
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A83314
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A834F7
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A837DE
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A8260D
                                                                                                                                                                        • Part of subcall function 00A4BF40: GetFileAttributesA.KERNEL32(?,?,BEBEA9B5), ref: 00A4BF6E
                                                                                                                                                                        • Part of subcall function 00A4BF40: __Mtx_unlock.LIBCPMT ref: 00A4BF9E
                                                                                                                                                                        • Part of subcall function 00AA5A60: Concurrency::cancel_current_task.LIBCPMT ref: 00AA5B47
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A8272E
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A8275D
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A8290D
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A8296B
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A82B1A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateDirectory$FolderPath$AttributesConcurrency::cancel_current_taskFileMtx_unlock
                                                                                                                                                                      • String ID: #lf~$hf+_$j4qo$r,am$ugbi$ya}q$~ {h
                                                                                                                                                                      • API String ID: 4270311917-2415974981
                                                                                                                                                                      • Opcode ID: ea4cd2d2ac02016ae0e96dca2d3a39c54cfa10a70b4d444fb579d984f3b9d25e
                                                                                                                                                                      • Instruction ID: 7f8a5abc1c2481be715a8b21f42576b734618a5842f6e72e39650925854041d5
                                                                                                                                                                      • Opcode Fuzzy Hash: ea4cd2d2ac02016ae0e96dca2d3a39c54cfa10a70b4d444fb579d984f3b9d25e
                                                                                                                                                                      • Instruction Fuzzy Hash: 1743ADB4C042589ADF25EB64CD56BEEB774AF61304F4441D8E44977282EF706B88CFA2
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A824F0 Relevance: 53.3, APIs: 22, Strings: 7, Instructions: 2535COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A82580
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A825DC
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A82F83
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A8260D
                                                                                                                                                                        • Part of subcall function 00A4BF40: GetFileAttributesA.KERNEL32(?,?,BEBEA9B5), ref: 00A4BF6E
                                                                                                                                                                        • Part of subcall function 00A4BF40: __Mtx_unlock.LIBCPMT ref: 00A4BF9E
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A8272E
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A8275D
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A8290D
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A8296B
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A82B1A
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateDirectory$FolderPath$AttributesFileMtx_unlock
                                                                                                                                                                      • String ID: #lf~$hf+_$j4qo$r,am$ugbi$ya}q$~ {h
                                                                                                                                                                      • API String ID: 2791087084-2415974981
                                                                                                                                                                      • Opcode ID: 931ba3ee59f7d99801723ddf308af05560d209cd2fdfdbfdba1f899f0c51cdad
                                                                                                                                                                      • Instruction ID: 18816cc1ad7a8922770f26fe7a406a8296b547f14f62513795301bfc16ae4ac1
                                                                                                                                                                      • Opcode Fuzzy Hash: 931ba3ee59f7d99801723ddf308af05560d209cd2fdfdbfdba1f899f0c51cdad
                                                                                                                                                                      • Instruction Fuzzy Hash: 0A338DB4C042589ADF25EB64CD56BEEB774AF61304F4441D8E44977282EF706B88CFA2
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A4F000 Relevance: 30.2, APIs: 19, Instructions: 1719COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$AttributesFile
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1886074773-0
                                                                                                                                                                      • Opcode ID: e6a460e0cfe2f05b2d6228945c4a5deeca8c770dd3cb4e8535f78567d0f43c1c
                                                                                                                                                                      • Instruction ID: 3f62a98d10d535156e1517db47b883e5ce811c47a36b79a4cbaf4d411f5d0aa4
                                                                                                                                                                      • Opcode Fuzzy Hash: e6a460e0cfe2f05b2d6228945c4a5deeca8c770dd3cb4e8535f78567d0f43c1c
                                                                                                                                                                      • Instruction Fuzzy Hash: 31D25A71D002489FDF08DBB8CC85BFDBBB5AF46304F64826CE846A7192D7749A89CB51
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A50530 Relevance: 30.1, APIs: 13, Strings: 2, Instructions: 3825COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?,?), ref: 00A50734
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A50762
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A5098D
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A5099C
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A50D36
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A50D46
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A50F26
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A50F35
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A51076
                                                                                                                                                                        • Part of subcall function 00A4BF40: GetFileAttributesA.KERNEL32(?,?,BEBEA9B5), ref: 00A4BF6E
                                                                                                                                                                        • Part of subcall function 00A4BF40: __Mtx_unlock.LIBCPMT ref: 00A4BF9E
                                                                                                                                                                        • Part of subcall function 00AA5A60: Concurrency::cancel_current_task.LIBCPMT ref: 00AA5B47
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A51085
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A5121B
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A513C5
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00A513EC
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$AttributesFileFolderPath$Concurrency::cancel_current_task
                                                                                                                                                                      • String ID: mgw$mgww
                                                                                                                                                                      • API String ID: 1290385620-1752192256
                                                                                                                                                                      • Opcode ID: 6a27d5ab73157c6a0d42cd819cbb28f6e985a7f79a4c343c6afce145c32b21ff
                                                                                                                                                                      • Instruction ID: e2004034a938070bd653d4fed32d2dacaaddd7520eded1d54f2ab0730b2d249b
                                                                                                                                                                      • Opcode Fuzzy Hash: 6a27d5ab73157c6a0d42cd819cbb28f6e985a7f79a4c343c6afce145c32b21ff
                                                                                                                                                                      • Instruction Fuzzy Hash: AD73D074D00258DADF14EB64CD56BEEBB75BF52304F4441D8E84967282EB706B88CFA2
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A9CDC0 Relevance: 29.1, APIs: 18, Instructions: 2073COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00A824F0: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A82580
                                                                                                                                                                        • Part of subcall function 00A824F0: CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A825DC
                                                                                                                                                                        • Part of subcall function 00A824F0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A8260D
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?,9987BAB5,00B73AFC,00000000,9987BAB5,9987BAB6), ref: 00A9CEC2
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D0D6
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D0E5
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D2F6
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D305
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D506
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D515
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D806
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9D815
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9DD0E
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9DD1D
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9DF16
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9DF25
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9E127
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9E136
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9E426
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9E435
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,?,808ABDB5,00B73AFC,00000000,808ABDB5,808ABDB6), ref: 00A9DAFC
                                                                                                                                                                        • Part of subcall function 00AAD420: Concurrency::cancel_current_task.LIBCPMT ref: 00AAD4FD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$CreateDirectory$Concurrency::cancel_current_taskFolderPath
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 791088107-0
                                                                                                                                                                      • Opcode ID: 3a62eafeeb4fc8884879a1d978ff590e0a80329d9789def9857387c22bbce6ad
                                                                                                                                                                      • Instruction ID: 8285cdcb21efbd9a8192efb82db30f7544a769189083bf933f51a50a96bb502a
                                                                                                                                                                      • Opcode Fuzzy Hash: 3a62eafeeb4fc8884879a1d978ff590e0a80329d9789def9857387c22bbce6ad
                                                                                                                                                                      • Instruction Fuzzy Hash: A3031731E00258CFDF18DB68CC85BEDBBF5AF56304F548298E449A7692DB709AC4CB61
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A94EF0 Relevance: 24.6, APIs: 11, Strings: 1, Instructions: 3585COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9607E
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9608D
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00A9708F
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A972FC
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A9730B
                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?), ref: 00A9806E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$AttributesCreateDirectoryFile
                                                                                                                                                                      • String ID: type must be boolean, but is
                                                                                                                                                                      • API String ID: 3883471643-4184302307
                                                                                                                                                                      • Opcode ID: 63d6ea56d9ae1a6fee3dd8526bea5276d0861cc009df2d8216cf2e8090d02964
                                                                                                                                                                      • Instruction ID: 0804304bdc81a32b1f85a9aaf8bb0e4311da333ba5ae863ed665eb88ac0a9a41
                                                                                                                                                                      • Opcode Fuzzy Hash: 63d6ea56d9ae1a6fee3dd8526bea5276d0861cc009df2d8216cf2e8090d02964
                                                                                                                                                                      • Instruction Fuzzy Hash: 0673BD70E042588ADF29DB68C9587EEBBF4AF06304F5441D8E449A7292DB749F88CF61
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A7D840 Relevance: 19.1, APIs: 7, Strings: 3, Instructions: 1648COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?,00B76240), ref: 00A7D9D0
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A7DA00
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A7E566
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A7E576
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A7EF0D
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A7DAEC
                                                                                                                                                                        • Part of subcall function 00AAD420: Concurrency::cancel_current_task.LIBCPMT ref: 00AAD4FD
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A7EEC4
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$AttributesConcurrency::cancel_current_taskFile
                                                                                                                                                                      • String ID: invalid stoi argument$stoi argument out of range$Y
                                                                                                                                                                      • API String ID: 3826552558-3734600978
                                                                                                                                                                      • Opcode ID: 64a52e810dead6dffd8f830e089ccab6c958643721b6a75caa792965b75a934b
                                                                                                                                                                      • Instruction ID: 7d94602a603581d10c8261f148762de07e613661b40bec53b8b959d0756a7c04
                                                                                                                                                                      • Opcode Fuzzy Hash: 64a52e810dead6dffd8f830e089ccab6c958643721b6a75caa792965b75a934b
                                                                                                                                                                      • Instruction Fuzzy Hash: D0E2D2709002588FEF19CB68CC99BEEBBB5AF4A304F14C2D8D04DAB692D7745AC5CB51
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A743E0 Relevance: 14.5, APIs: 4, Strings: 3, Instructions: 2268COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A757F6
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A75805
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A75C66
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A75C75
                                                                                                                                                                        • Part of subcall function 00AAD420: Concurrency::cancel_current_task.LIBCPMT ref: 00AAD4FD
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$Concurrency::cancel_current_task
                                                                                                                                                                      • String ID: AAHY$DEQs$cannot use operator[] with a string argument with
                                                                                                                                                                      • API String ID: 944788145-3880095171
                                                                                                                                                                      • Opcode ID: 6a22c260de8e5b6462897d936ad53d1d1d27f92d860693d5279fd2ea88e85668
                                                                                                                                                                      • Instruction ID: 292e0313a17440fa4b6b5540613c5c4ebb71503c8a92147b0fbc2cf374164066
                                                                                                                                                                      • Opcode Fuzzy Hash: 6a22c260de8e5b6462897d936ad53d1d1d27f92d860693d5279fd2ea88e85668
                                                                                                                                                                      • Instruction Fuzzy Hash: 4223DE70C002588BDB29DF24CD997EEBBB5AF55304F1482D8E44D67292EB706B89CF91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A7A9A0 Relevance: 12.0, APIs: 2, Strings: 4, Instructions: 1484libraryCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A7B86A
                                                                                                                                                                      • LoadLibraryA.KERNEL32(809E8B9F,?), ref: 00A7BCE6
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: LibraryLoadUnothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                      • String ID: )"ke$I+8/$cannot use operator[] with a string argument with $in/-
                                                                                                                                                                      • API String ID: 2188052229-2929684172
                                                                                                                                                                      • Opcode ID: c1bbed838b4aae3372beb41dc0011be84dbd1eb278be9e3af2b9beab35da0621
                                                                                                                                                                      • Instruction ID: d0047bb3f5849b95fcbeefe48dd33198503ec8f88ce81f15cf953b5666a9d18c
                                                                                                                                                                      • Opcode Fuzzy Hash: c1bbed838b4aae3372beb41dc0011be84dbd1eb278be9e3af2b9beab35da0621
                                                                                                                                                                      • Instruction Fuzzy Hash: 41D20370D10258CFEB25CF64CC45BEEBBB5AF55304F1481DDE449AB292EB709A84CBA1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A4C000 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 262COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 11043 a4c000-a4c038 call b1bed2 11046 a4c3c2-a4c3c3 call b1bb7b 11043->11046 11047 a4c03e-a4c077 11043->11047 11050 a4c3c8 call a42040 11046->11050 11049 a4c07d-a4c106 call aad420 FindFirstFileA 11047->11049 11047->11050 11059 a4c10c 11049->11059 11060 a4c319 11049->11060 11054 a4c3cd-a4c3d2 call b21e70 11050->11054 11062 a4c110-a4c119 11059->11062 11061 a4c31b-a4c321 11060->11061 11063 a4c323-a4c32f 11061->11063 11064 a4c34f-a4c367 11061->11064 11065 a4c120-a4c125 11062->11065 11066 a4c345-a4c34c call b1cbd1 11063->11066 11067 a4c331-a4c33f 11063->11067 11069 a4c391-a4c3c1 call b1bee3 11064->11069 11070 a4c369-a4c375 11064->11070 11065->11065 11068 a4c127-a4c173 11065->11068 11066->11064 11067->11054 11067->11066 11068->11050 11080 a4c179-a4c24c call aad420 call aa5770 call aa58e0 11068->11080 11073 a4c387-a4c38e call b1cbd1 11070->11073 11074 a4c377-a4c385 11070->11074 11073->11069 11074->11054 11074->11073 11091 a4c26c-a4c285 11080->11091 11092 a4c24e-a4c255 call a4c000 11080->11092 11095 a4c30f-a4c317 11091->11095 11096 a4c28b-a4c29f 11091->11096 11092->11091 11095->11061 11096->11095 11099 a4c2a1-a4c2b2 FindNextFileA 11096->11099 11099->11062 11100 a4c2b8-a4c2ca 11099->11100 11100->11061 11103 a4c2cc-a4c2d2 11100->11103 11104 a4c2d4 11103->11104 11105 a4c2d6-a4c2e4 SetFileAttributesA 11103->11105 11104->11105 11106 a4c2e6-a4c2ef 11105->11106 11107 a4c2f1-a4c2f5 11105->11107 11106->11061 11108 a4c2f7 11107->11108 11109 a4c2f9-a4c302 RemoveDirectoryA 11107->11109 11108->11109 11109->11060 11111 a4c304-a4c30d 11109->11111 11111->11061
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: \*.*
                                                                                                                                                                      • API String ID: 0-1173974218
                                                                                                                                                                      • Opcode ID: 05c2baddfc1aa3eec76d2a4d1cd27d1c923a8666e4adef713172cc7eb208e3c2
                                                                                                                                                                      • Instruction ID: 19f3d5e212b45b5609b89c976edd36c3f9966661ffd10ee994a2b3b1ed140585
                                                                                                                                                                      • Opcode Fuzzy Hash: 05c2baddfc1aa3eec76d2a4d1cd27d1c923a8666e4adef713172cc7eb208e3c2
                                                                                                                                                                      • Instruction Fuzzy Hash: 6E91F431D02209DFDB14DFA8C944BEDB7B5BF85314F244698E419B7292DB71AE80CBA0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A51370 Relevance: 9.5, APIs: 2, Strings: 2, Instructions: 2459COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00A513C5
                                                                                                                                                                      • SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00A513EC
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FolderPath
                                                                                                                                                                      • String ID: mgw$mgww
                                                                                                                                                                      • API String ID: 1514166925-1752192256
                                                                                                                                                                      • Opcode ID: 40a06e1b289db1c76076b5959008fbf5cc523f251e459fb3f7df1f673a0f326c
                                                                                                                                                                      • Instruction ID: a466fdf4bb2cf7ac668dac298f634eb107a0d0bafaa6e943a76527130ba1fee3
                                                                                                                                                                      • Opcode Fuzzy Hash: 40a06e1b289db1c76076b5959008fbf5cc523f251e459fb3f7df1f673a0f326c
                                                                                                                                                                      • Instruction Fuzzy Hash: CE33CE74D042589ADF20EB74CE56BEDBB75AF61304F4441D8E84967282EF705B88CFA2
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B1A450 Relevance: 9.2, Strings: 7, Instructions: 490COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 12527 b1a450-b1a46e call b18f50 12530 b1aad1-b1aad7 12527->12530 12531 b1a474-b1a47d 12527->12531 12532 b1a483-b1a489 12531->12532 12533 b1a47f-b1a481 12531->12533 12535 b1a48b-b1a48d 12532->12535 12536 b1a48f-b1a4a0 12532->12536 12534 b1a4a3-b1a4a9 12533->12534 12537 b1a4b3-b1a4ba 12534->12537 12538 b1a4ab-b1a4b1 12534->12538 12535->12534 12536->12534 12539 b1a4c2-b1a4d9 call acb220 12537->12539 12540 b1a4bc 12537->12540 12538->12539 12543 b1aab6 12539->12543 12544 b1a4df-b1a4f1 call b1ebb0 12539->12544 12540->12539 12546 b1aab8 12543->12546 12549 b1a595-b1a59a 12544->12549 12550 b1a4f7-b1a4fe 12544->12550 12548 b1aabf-b1aac7 call b19a90 12546->12548 12558 b1aac9-b1aacf 12548->12558 12553 b1a5a6-b1a65e call acada0 12549->12553 12554 b1a59c-b1a5a3 12549->12554 12555 b1a500-b1a507 12550->12555 12556 b1a509-b1a519 12550->12556 12567 b1a660-b1a671 call acd5c0 12553->12567 12568 b1a676-b1a6e5 call b1a2b0 * 4 12553->12568 12554->12553 12557 b1a51b-b1a522 12555->12557 12556->12549 12556->12557 12561 b1a584-b1a58b 12557->12561 12562 b1a524-b1a52b 12557->12562 12558->12530 12573 b1a58e-b1a590 12561->12573 12565 b1a537-b1a571 12562->12565 12566 b1a52d-b1a534 12562->12566 12565->12573 12585 b1a573-b1a57f 12565->12585 12566->12565 12578 b1aa40 12567->12578 12579 b1aa42-b1aa47 12568->12579 12597 b1a6eb-b1a733 call af6490 call b1a2b0 12568->12597 12573->12546 12578->12579 12582 b1aa53-b1aa5b 12579->12582 12583 b1aa49-b1aa50 12579->12583 12587 b1aa86-b1aa8c 12582->12587 12588 b1aa5d-b1aa62 12582->12588 12583->12582 12585->12546 12587->12546 12592 b1aa8e-b1aa9a 12587->12592 12588->12587 12591 b1aa64-b1aa69 12588->12591 12591->12587 12595 b1aa6b-b1aa85 12591->12595 12592->12548 12596 b1aa9c-b1aa9e 12592->12596 12596->12558 12598 b1aaa0-b1aab5 12596->12598 12603 b1a735-b1a738 12597->12603 12604 b1a73a-b1a740 12597->12604 12603->12604 12605 b1a746-b1a757 call ad62e0 12603->12605 12604->12605 12608 b1a8e5-b1a8ff call acd5c0 12605->12608 12609 b1a75d-b1a765 12605->12609 12608->12578 12610 b1a76b-b1a77f 12609->12610 12611 b1a8dd-b1a8df 12609->12611 12610->12611 12613 b1a785-b1a791 12610->12613 12611->12608 12614 b1a794-b1a7e4 call af6a40 * 2 12611->12614 12613->12614 12614->12579 12621 b1a7ea-b1a815 call acd5c0 call b1a130 12614->12621 12626 b1a8b3-b1a8c1 12621->12626 12627 b1a81b 12621->12627 12629 b1a8c7-b1a8cc 12626->12629 12630 b1a9f9-b1aa01 12626->12630 12628 b1a820-b1a824 12627->12628 12628->12628 12631 b1a826-b1a837 12628->12631 12634 b1a8d0-b1a8d7 12629->12634 12632 b1aa11-b1aa15 12630->12632 12633 b1aa03-b1aa08 12630->12633 12635 b1a843-b1a85b call af66e0 12631->12635 12636 b1a839-b1a840 12631->12636 12632->12578 12638 b1aa17-b1aa1d 12632->12638 12633->12632 12637 b1aa0a-b1aa0f 12633->12637 12639 b1a904-b1a913 12634->12639 12640 b1a8d9-b1a8db 12634->12640 12652 b1a879-b1a87f 12635->12652 12653 b1a85d-b1a876 call b1a130 12635->12653 12636->12635 12637->12578 12637->12632 12638->12578 12642 b1aa1f-b1aa38 call acd5c0 call b196e0 12638->12642 12643 b1a91f-b1a925 12639->12643 12650 b1a915-b1a91c 12639->12650 12640->12643 12668 b1aa3d 12642->12668 12646 b1a927-b1a92c 12643->12646 12647 b1a92e-b1a933 12643->12647 12651 b1a936-b1a938 12646->12651 12647->12651 12650->12643 12655 b1a944-b1a94b 12651->12655 12656 b1a93a-b1a941 12651->12656 12658 b1a881-b1a891 call acd5c0 12652->12658 12659 b1a896-b1a89e 12652->12659 12653->12652 12665 b1a979-b1a97b 12655->12665 12666 b1a94d-b1a95e 12655->12666 12656->12655 12658->12659 12661 b1a8a0-b1a8a7 12659->12661 12662 b1a8aa-b1a8ad 12659->12662 12661->12662 12662->12626 12671 b1a8af 12662->12671 12669 b1a9e8-b1a9f3 12665->12669 12670 b1a97d-b1a984 12665->12670 12680 b1a960-b1a973 call acd5c0 12666->12680 12681 b1a976 12666->12681 12668->12578 12669->12630 12669->12634 12675 b1a986-b1a98d 12670->12675 12676 b1a9de 12670->12676 12671->12626 12678 b1a999-b1a9d3 12675->12678 12679 b1a98f-b1a996 12675->12679 12683 b1a9e5 12676->12683 12678->12669 12688 b1a9d5-b1a9dc 12678->12688 12679->12678 12680->12681 12681->12665 12683->12669 12688->12683
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
                                                                                                                                                                      • API String ID: 0-1885142750
                                                                                                                                                                      • Opcode ID: eae26b1a6db52d5de4c7e92fe0b3fd78c7ba838e13b117556b7db373cb3b2027
                                                                                                                                                                      • Instruction ID: 1d55322bd8cb0e85f769594de2cd4b0af17d46fd7004df8fda72f93e3dba7865
                                                                                                                                                                      • Opcode Fuzzy Hash: eae26b1a6db52d5de4c7e92fe0b3fd78c7ba838e13b117556b7db373cb3b2027
                                                                                                                                                                      • Instruction Fuzzy Hash: B4020770A017009FE7209F24DD45BAA77E5EF40704F5444ACE44A9B291EBB5FAC5CB92
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A6FDC0 Relevance: 8.0, APIs: 1, Strings: 3, Instructions: 975COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • std::locale::_Init.LIBCPMT ref: 00A7047E
                                                                                                                                                                        • Part of subcall function 00AA8E30: std::_Lockit::_Lockit.LIBCPMT ref: 00AA8E5E
                                                                                                                                                                        • Part of subcall function 00AA8E30: std::_Lockit::_Lockit.LIBCPMT ref: 00AA8E81
                                                                                                                                                                        • Part of subcall function 00AA8E30: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA8EA1
                                                                                                                                                                        • Part of subcall function 00AA8E30: std::_Lockit::~_Lockit.LIBCPMT ref: 00AA8ED5
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Lockitstd::_$Lockit::_Lockit::~_$Initstd::locale::_
                                                                                                                                                                      • String ID: +W!$.Bna$n:
                                                                                                                                                                      • API String ID: 1226965381-3865824878
                                                                                                                                                                      • Opcode ID: 9215f646d9ce9bcbecbbefba7eef17ea39cb3fbc3ca733a0e583f27a64f65ac2
                                                                                                                                                                      • Instruction ID: 3c5012b6efc2ac4b9da4cf79dd4442ff496352fcbc92f40120be2d5b7a6a6bd6
                                                                                                                                                                      • Opcode Fuzzy Hash: 9215f646d9ce9bcbecbbefba7eef17ea39cb3fbc3ca733a0e583f27a64f65ac2
                                                                                                                                                                      • Instruction Fuzzy Hash: 8C82F471D00248CFDB18DF68CD85BEEBBB1BF45304F14829DE449AB692D774AA84CB91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A68070 Relevance: 7.5, APIs: 1, Strings: 2, Instructions: 2231COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Initstd::locale::_
                                                                                                                                                                      • String ID: &!")$cannot use operator[] with a string argument with
                                                                                                                                                                      • API String ID: 1620887387-2654547935
                                                                                                                                                                      • Opcode ID: 129a9d23b027ffa045df7c4d39b370846ec30d43bf1c76178d7867caea8941d8
                                                                                                                                                                      • Instruction ID: 7dd46325fc150255d4a9cafca8d3dd42a48d408e61217d622e1905da5cce4a83
                                                                                                                                                                      • Opcode Fuzzy Hash: 129a9d23b027ffa045df7c4d39b370846ec30d43bf1c76178d7867caea8941d8
                                                                                                                                                                      • Instruction Fuzzy Hash: 3C23ED70D00258CBDB25DF64C955BEEBBB4AF55304F0442E8E44967292EB74AF88CFA1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A78F30 Relevance: 6.9, Strings: 4, Instructions: 1892COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: WqL_$^YZQ$cannot use operator[] with a string argument with $dFC
                                                                                                                                                                      • API String ID: 0-2181824182
                                                                                                                                                                      • Opcode ID: 384294ead0376140d726b2b1d0145f1ed446459de9c3c544dbdbd1fc4b1d101b
                                                                                                                                                                      • Instruction ID: e4ed850c6debe5fccbdc59514f96be4e878c439c4ff566fa854f7e046d222b28
                                                                                                                                                                      • Opcode Fuzzy Hash: 384294ead0376140d726b2b1d0145f1ed446459de9c3c544dbdbd1fc4b1d101b
                                                                                                                                                                      • Instruction Fuzzy Hash: 5603B070D00259DFDB25CF28CC54BEEBBB4AF55304F1481E9E449A7282EB75AE84CB91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A6A260 Relevance: 6.6, APIs: 1, Strings: 2, Instructions: 1391COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00A6B148
                                                                                                                                                                      Strings
                                                                                                                                                                      • cannot use operator[] with a string argument with , xrefs: 00A6B513
                                                                                                                                                                      • y3?|, xrefs: 00A6ADE8
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                      • String ID: cannot use operator[] with a string argument with $y3?|
                                                                                                                                                                      • API String ID: 885266447-1582911217
                                                                                                                                                                      • Opcode ID: aeee80b387c9d91ae875779dcc5e6850fb1c667dd6ce684426b721e919a472bd
                                                                                                                                                                      • Instruction ID: ccbc823590033eb119095ca76ece1453b20eadb61e47961e2f982f0022a0d9c6
                                                                                                                                                                      • Opcode Fuzzy Hash: aeee80b387c9d91ae875779dcc5e6850fb1c667dd6ce684426b721e919a472bd
                                                                                                                                                                      • Instruction Fuzzy Hash: F6C2F571D002598FDB28CF68CD457EEBBB5AF55304F148298E449B7282DB70AE85CFA1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A76840 Relevance: 6.2, Strings: 4, Instructions: 1179COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock
                                                                                                                                                                      • String ID: Vld~$`ffc$cannot use operator[] with a string argument with $e}am
                                                                                                                                                                      • API String ID: 1418687624-951248972
                                                                                                                                                                      • Opcode ID: 83b2a4e095b54b600023511f276714e481b56db1691f7920280b073476df3f3b
                                                                                                                                                                      • Instruction ID: c882dd61a8dd69ef346a19bc66c1c2aa3140d4cd6a1c539fcdbaac9c1af80dc9
                                                                                                                                                                      • Opcode Fuzzy Hash: 83b2a4e095b54b600023511f276714e481b56db1691f7920280b073476df3f3b
                                                                                                                                                                      • Instruction Fuzzy Hash: 8DB2E270D042588FDB25DF68CD45BEEBBB5AF15304F1481DCE449AB292EB709A88CF91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A77900 Relevance: 5.3, Strings: 3, Instructions: 1514COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: )"ke$cannot use operator[] with a string argument with $in/-
                                                                                                                                                                      • API String ID: 0-2560966125
                                                                                                                                                                      • Opcode ID: eee9924ceb7a1994715ac700618d6d77511ae86700998f16b0cb7d69f5bfd39e
                                                                                                                                                                      • Instruction ID: e6c004733d5339bb4b81cd56f4a579bb1f46a5559edd681bc78333f25139c6df
                                                                                                                                                                      • Opcode Fuzzy Hash: eee9924ceb7a1994715ac700618d6d77511ae86700998f16b0cb7d69f5bfd39e
                                                                                                                                                                      • Instruction Fuzzy Hash: 6FD2C370D042588FDB25CB28CD59BEEBBB5AF55304F1482D8E44DA7282EB749E84CF91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A64230 Relevance: 5.2, Strings: 3, Instructions: 1419COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: )nd{$cannot use operator[] with a string argument with $cb`q
                                                                                                                                                                      • API String ID: 0-869489081
                                                                                                                                                                      • Opcode ID: 3df4ef7e56edb9c09d041e4b8db7dbf409ac8a044e1fed7e505a73ae68928d70
                                                                                                                                                                      • Instruction ID: d960628978fedb38af1e4d84564f73a53ebeacab30ea55cab7114e002c4e1880
                                                                                                                                                                      • Opcode Fuzzy Hash: 3df4ef7e56edb9c09d041e4b8db7dbf409ac8a044e1fed7e505a73ae68928d70
                                                                                                                                                                      • Instruction Fuzzy Hash: 7CC2C171D00258CFDB19CF68CC557EEBBB1BF59304F148298E449AB282DB74AA85CF91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A6D970 Relevance: 4.6, Strings: 2, Instructions: 2083COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Initstd::locale::_
                                                                                                                                                                      • String ID: SGMP$hmm[
                                                                                                                                                                      • API String ID: 1620887387-32124266
                                                                                                                                                                      • Opcode ID: ee707d48b29a26c665f27089eb90688dc98004271169e2d8a378caac43adb45d
                                                                                                                                                                      • Instruction ID: 2787ecc759121e470b25037c0bee276eeebb11dca2ca33f5180b23ea384dc32d
                                                                                                                                                                      • Opcode Fuzzy Hash: ee707d48b29a26c665f27089eb90688dc98004271169e2d8a378caac43adb45d
                                                                                                                                                                      • Instruction Fuzzy Hash: 6B13D070D002588FEB18CF68CD95BEDBBB5AF55304F1082D8E449BB292D7749B84CBA0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A80600 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 954registryCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 20190 a80600-a806bd call aa38d0 call aa38a0 call a50500 call aa9b20 call aa3520 20201 a806c3-a806fa call aa5a60 call a427a0 RegOpenKeyExA 20190->20201 20206 a80700-a80738 call b1ebb0 20201->20206 20207 a81454-a81478 call a42660 20201->20207 20214 a8144b-a81453 20206->20214 20215 a8073e 20206->20215 20207->20201 20212 a8147e-a81496 20207->20212 20214->20207 20216 a80740-a8075d 20215->20216 20219 a8140d-a81445 call b1ebb0 20216->20219 20220 a80763-a80822 call b1ebb0 * 5 20216->20220 20219->20214 20219->20216 20234 a80826-a80831 20220->20234 20234->20234 20235 a80833-a80859 20234->20235 20237 a8085f-a808bc 20235->20237 20238 a81404-a8140c 20235->20238 20239 a808c2-a808c7 20237->20239 20238->20219 20239->20239 20240 a808c9-a8093a call a42810 call b1ebb0 * 2 20239->20240 20248 a80940-a8094b 20240->20248 20248->20248 20249 a8094d-a80973 20248->20249 20251 a80975-a809c4 call a4d9b0 20249->20251 20252 a809c6-a809cd 20249->20252 20251->20252 20257 a80a1d-a80a3e 20251->20257 20253 a809eb-a809f2 20252->20253 20254 a809cf-a809d5 20252->20254 20253->20257 20258 a809f4-a809fd 20253->20258 20256 a809d8-a809dd 20254->20256 20256->20256 20260 a809df-a809e1 20256->20260 20262 a80a40-a80a4b 20257->20262 20261 a80a00-a80a05 20258->20261 20260->20253 20264 a809e3-a809e9 20260->20264 20261->20261 20265 a80a07-a80a09 20261->20265 20262->20262 20266 a80a4d-a80a70 20262->20266 20267 a80a11-a80a18 call aa5880 20264->20267 20265->20257 20268 a80a0b 20265->20268 20271 a80b83-a80b8a 20266->20271 20272 a80a76-a80acb call a4a6c0 20266->20272 20267->20257 20268->20267 20273 a80b8c-a80b92 20271->20273 20274 a80bcd-a80bd4 20271->20274 20272->20271 20292 a80ad1-a80b26 call a4a6c0 20272->20292 20276 a80b95-a80b9a 20273->20276 20278 a80c18-a80c1f 20274->20278 20279 a80bd6-a80bdf 20274->20279 20276->20276 20280 a80b9c-a80b9e 20276->20280 20281 a80c6b-a80c72 20278->20281 20282 a80c21-a80c2a 20278->20282 20283 a80be0-a80be5 20279->20283 20280->20274 20284 a80ba0-a80bc8 call a4b830 call aa5880 20280->20284 20287 a80cca-a80d2c call aa5590 * 2 call aa55b0 call aaa4c0 call aa55d0 20281->20287 20288 a80c74-a80c7d 20281->20288 20285 a80c30-a80c35 20282->20285 20283->20283 20289 a80be7-a80be9 20283->20289 20315 a80cbc-a80cc7 call a5fe20 20284->20315 20285->20285 20291 a80c37-a80c39 20285->20291 20332 a80d31-a80dbf call aa7470 call b1c950 call aa5a60 20287->20332 20294 a80c80-a80c85 20288->20294 20289->20278 20295 a80beb-a80c13 call a4b830 call aa5880 20289->20295 20291->20281 20297 a80c3b-a80c69 call a4b830 call aa5880 20291->20297 20292->20271 20322 a80b28-a80b7d call a4a6c0 20292->20322 20294->20294 20300 a80c87-a80c89 20294->20300 20295->20315 20297->20315 20300->20287 20302 a80c8b-a80cb6 call a4b830 call aa5880 20300->20302 20302->20315 20315->20287 20322->20271 20322->20332 20339 a80dc3-a80dce 20332->20339 20339->20339 20340 a80dd0-a80ddc 20339->20340 20341 a80e0c-a80e0e 20340->20341 20342 a80dde-a80e0a call aa7470 20340->20342 20344 a80e14 20341->20344 20345 a81497-a814ea call aa7740 call a42700 call aa98d0 call a48920 call b1e5bb 20341->20345 20346 a80e1a-a80e3e 20342->20346 20344->20346 20368 a814ef-a814f4 call b21e70 20345->20368 20349 a80e41-a80e46 20346->20349 20349->20349 20351 a80e48-a80e7b call a42810 call aacba0 20349->20351 20362 a80eac-a80f6e call aa3500 call b1c950 call aa5a60 20351->20362 20363 a80e7d-a80e8c 20351->20363 20378 a80f70-a80f7b 20362->20378 20365 a80e8e-a80e9c 20363->20365 20366 a80ea2-a80ea9 call b1cbd1 20363->20366 20365->20366 20365->20368 20366->20362 20378->20378 20379 a80f7d-a80fa2 20378->20379 20380 a80fa5-a80faa 20379->20380 20380->20380 20381 a80fac-a80fe0 call a42810 call aacba0 20380->20381 20386 a81011-a810ae call aa3500 call b1c950 20381->20386 20387 a80fe2-a80ff1 20381->20387 20396 a810b5-a810ba 20386->20396 20389 a80ff3-a81001 20387->20389 20390 a81007-a8100e call b1cbd1 20387->20390 20389->20368 20389->20390 20390->20386 20396->20396 20397 a810bc-a810f0 call a42810 20396->20397 20400 a810f4-a810ff 20397->20400 20400->20400 20401 a81101-a81129 20400->20401 20402 a81130-a81135 20401->20402 20402->20402 20403 a81137-a8116b call a42810 call aacba0 20402->20403 20408 a8119c-a81261 call aa3500 call b1c950 call aa5a60 20403->20408 20409 a8116d-a8117c 20403->20409 20420 a81267-a81272 20408->20420 20410 a8117e-a8118c 20409->20410 20411 a81192-a81199 call b1cbd1 20409->20411 20410->20368 20410->20411 20411->20408 20420->20420 20421 a81274-a8129c 20420->20421 20422 a812a0-a812a5 20421->20422 20422->20422 20423 a812a7-a812db call a42810 call aacba0 20422->20423 20428 a8130c-a8136f call aa3500 20423->20428 20429 a812dd-a812ec 20423->20429 20436 a81370-a8137b 20428->20436 20430 a812ee-a812fc 20429->20430 20431 a81302-a81309 call b1cbd1 20429->20431 20430->20368 20430->20431 20431->20428 20436->20436 20437 a8137d-a813b2 call aa9b20 call aa2e80 call aa3500 20436->20437 20444 a813b4-a813c2 call a427b0 20437->20444 20445 a813c7-a813fe call a42660 * 2 20437->20445 20444->20445 20445->20238
                                                                                                                                                                      APIs
                                                                                                                                                                      • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,00B761C0,00000000), ref: 00A806F2
                                                                                                                                                                      Strings
                                                                                                                                                                      • cannot use operator[] with a string argument with , xrefs: 00A814AF
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Open
                                                                                                                                                                      • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                      • API String ID: 71445658-2766135566
                                                                                                                                                                      • Opcode ID: 36ca64eb3b41c7d6767b8a000b5b1e7bcd5784e060f0eda69a531510ab82a028
                                                                                                                                                                      • Instruction ID: 0b6c7918a8eff8f5bcf6b7dd2352c37be06bbd3794452027036d65fb5bf772c1
                                                                                                                                                                      • Opcode Fuzzy Hash: 36ca64eb3b41c7d6767b8a000b5b1e7bcd5784e060f0eda69a531510ab82a028
                                                                                                                                                                      • Instruction Fuzzy Hash: 1792BD70C00258DEEB25DF64CC94BEEBBB8AF56304F1441D9E449A7282EB755B88CF61
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A70390 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 554COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 21542 a70390-a70406 call aa5a60 call a4b890 21546 a7040b-a70447 21542->21546 21547 a70450-a7045f 21546->21547 21547->21547 21548 a70461-a704a5 call b1b75e call aa8e30 21547->21548 21553 a704a8-a704ad 21548->21553 21553->21553 21554 a704af-a7051e call aaa9c0 call aa5a60 call aa8e30 21553->21554 21562 a70524-a70562 call aa6ec0 call a6f960 21554->21562 21563 a70520 21554->21563 21568 a70757-a70777 21562->21568 21569 a70568-a7056a 21562->21569 21563->21562 21570 a7077d 21568->21570 21571 a7098c-a709a7 call aa7c60 call aa6ec0 21568->21571 21572 a70570-a70575 21569->21572 21573 a70780-a707c0 21570->21573 21590 a709bc-a709cd call aa7c60 21571->21590 21591 a709a9-a709b2 21571->21591 21574 a7072f-a7074e 21572->21574 21575 a7057b-a70592 21572->21575 21577 a707c6-a707cd 21573->21577 21578 a707c2-a707c4 21573->21578 21574->21572 21581 a70754 21574->21581 21579 a70598-a705a3 21575->21579 21582 a707cf 21577->21582 21583 a707d1-a707e9 21577->21583 21578->21582 21579->21579 21584 a705a5-a705cb 21579->21584 21581->21568 21582->21583 21586 a707eb-a707f7 21583->21586 21587 a707f9-a70802 call ab0cc0 21583->21587 21588 a705d0-a705d5 21584->21588 21592 a70807-a70817 call a6fdc0 21586->21592 21587->21592 21588->21588 21594 a705d7-a7062f call a42810 call aa5a60 call a4c3e0 call aa5a60 call aa7c60 21588->21594 21603 a709cf-a709de 21590->21603 21604 a709fe-a70a1f 21590->21604 21591->21590 21602 a709b4-a709b8 21591->21602 21605 a7081d-a70863 call aa5a60 * 3 21592->21605 21606 a70909-a70913 21592->21606 21663 a70635-a7068a call a42540 call aa5a60 call a5ff50 21594->21663 21664 a706f1-a706fb 21594->21664 21602->21590 21608 a709f4-a709fb call b1cbd1 21603->21608 21609 a709e0-a709ee 21603->21609 21611 a70a21-a70a2d 21604->21611 21612 a70a49-a70a61 21604->21612 21656 a708a6-a708ae call ab1540 21605->21656 21657 a70865-a708a4 call ab9350 21605->21657 21614 a70915-a70921 21606->21614 21615 a70941-a7094b 21606->21615 21608->21604 21609->21608 21622 a70aa1-a70ab9 call b21e70 21609->21622 21625 a70a3f-a70a46 call b1cbd1 21611->21625 21626 a70a2f-a70a3d 21611->21626 21618 a70a63-a70a6f 21612->21618 21619 a70a8b-a70aa0 21612->21619 21616 a70937-a7093e call b1cbd1 21614->21616 21617 a70923-a70931 21614->21617 21620 a7094d-a70959 21615->21620 21621 a70979-a70986 21615->21621 21616->21615 21617->21616 21617->21622 21631 a70a81-a70a88 call b1cbd1 21618->21631 21632 a70a71-a70a7f 21618->21632 21633 a7096f-a70976 call b1cbd1 21620->21633 21634 a7095b-a70969 21620->21634 21621->21571 21621->21573 21652 a70ae3-a70af7 21622->21652 21653 a70abb-a70ac5 21622->21653 21625->21612 21626->21622 21626->21625 21631->21619 21632->21622 21632->21631 21633->21621 21634->21622 21634->21633 21660 a70afd-a70b02 call b21e70 21652->21660 21654 a70ac7-a70ad5 21653->21654 21655 a70ad9-a70ae0 call b1cbd1 21653->21655 21659 a70ad7 21654->21659 21654->21660 21655->21652 21673 a708b1-a708b8 21656->21673 21657->21673 21659->21655 21691 a7068c-a70696 21663->21691 21692 a706b9-a706c3 21663->21692 21670 a706fd-a7070c 21664->21670 21671 a7072c 21664->21671 21675 a70722-a70729 call b1cbd1 21670->21675 21676 a7070e-a7071c 21670->21676 21671->21574 21678 a708ba-a708c9 21673->21678 21679 a708e9-a70904 call a5dad0 21673->21679 21675->21671 21676->21622 21676->21675 21682 a708df-a708e6 call b1cbd1 21678->21682 21683 a708cb-a708d9 21678->21683 21679->21606 21682->21679 21683->21622 21683->21682 21694 a706aa-a706b6 call ab26f0 21691->21694 21695 a70698-a706a8 call aa5a60 21691->21695 21692->21664 21693 a706c5-a706d1 21692->21693 21697 a706e7-a706ee call b1cbd1 21693->21697 21698 a706d3-a706e1 21693->21698 21694->21692 21695->21692 21697->21664 21698->21622 21698->21697
                                                                                                                                                                      APIs
                                                                                                                                                                        • Part of subcall function 00A4B890: __fread_nolock.LIBCMT ref: 00A4B97F
                                                                                                                                                                      • std::locale::_Init.LIBCPMT ref: 00A7047E
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Init__fread_nolockstd::locale::_
                                                                                                                                                                      • String ID: +W!
                                                                                                                                                                      • API String ID: 221842284-1925884894
                                                                                                                                                                      • Opcode ID: be80cc9dc75c522ab6e653bb9765be1b475fa5fa05070eaa5eef4a0924239ba9
                                                                                                                                                                      • Instruction ID: b564dcc810341dcbd6b53307072902d98974a1527e83511db964e74d9cf27b6f
                                                                                                                                                                      • Opcode Fuzzy Hash: be80cc9dc75c522ab6e653bb9765be1b475fa5fa05070eaa5eef4a0924239ba9
                                                                                                                                                                      • Instruction Fuzzy Hash: A322E371D00248CBDB18DF68CD89BAEBBB5BF45304F54C29CD449AB782D774AA84CB91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A65590 Relevance: 4.1, Strings: 1, Instructions: 2804COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Initstd::locale::_
                                                                                                                                                                      • String ID: fYZN
                                                                                                                                                                      • API String ID: 1620887387-2371140533
                                                                                                                                                                      • Opcode ID: 2b157d62f834cde757ceea8d0b1dc4e3355bd88cc4a78647dcd78335802c4785
                                                                                                                                                                      • Instruction ID: 88fa275f3d181ceb2a0ee72864f37ec9af203e723f8d639a63d74daa0815af1b
                                                                                                                                                                      • Opcode Fuzzy Hash: 2b157d62f834cde757ceea8d0b1dc4e3355bd88cc4a78647dcd78335802c4785
                                                                                                                                                                      • Instruction Fuzzy Hash: E443DD70D04258CBDB25DF28C955BEEBBB4AF55304F1441E8E449A7282EB74AF88CF91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A6B560 Relevance: 3.7, Strings: 1, Instructions: 2456COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      • cannot use operator[] with a string argument with , xrefs: 00A6D920
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Initstd::locale::_
                                                                                                                                                                      • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                      • API String ID: 1620887387-2766135566
                                                                                                                                                                      • Opcode ID: fb1db7e1cb4c995bf133dbc2862f10bbc2aef1227706483ebf0c915688d641a8
                                                                                                                                                                      • Instruction ID: 5ebb69d1c90cd764a711d76de4e19268d6723efa1f1d1bc80a1663385fea6c1c
                                                                                                                                                                      • Opcode Fuzzy Hash: fb1db7e1cb4c995bf133dbc2862f10bbc2aef1227706483ebf0c915688d641a8
                                                                                                                                                                      • Instruction Fuzzy Hash: 7C23E270D002588FDF19DF68CD457EEBBB1AF45304F1482D8E449AB292EB746B85CBA1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A93550 Relevance: 2.7, Strings: 1, Instructions: 1493COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$AttributesConcurrency::cancel_current_taskCreateDirectoryFile
                                                                                                                                                                      • String ID: /
                                                                                                                                                                      • API String ID: 1266625421-2043925204
                                                                                                                                                                      • Opcode ID: e71701d94f3cd5d03b3c9e37d63db6ce6c4a32d682002051511fef42ac6e2435
                                                                                                                                                                      • Instruction ID: 1c8fef88578edb91c89043a92714c0fd4fac5ff9f02f4b2f7a3cb6871d9a3411
                                                                                                                                                                      • Opcode Fuzzy Hash: e71701d94f3cd5d03b3c9e37d63db6ce6c4a32d682002051511fef42ac6e2435
                                                                                                                                                                      • Instruction Fuzzy Hash: 0EE28D74D002589ADF25EBA0CE56BEEBBB4AF55304F4444D8E40973292EF745B88CFA1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A62ED0 Relevance: 2.3, Strings: 1, Instructions: 1082COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      • cannot use operator[] with a string argument with , xrefs: 00A641BD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: cannot use operator[] with a string argument with
                                                                                                                                                                      • API String ID: 0-2766135566
                                                                                                                                                                      • Opcode ID: 24d633434489166fcc7434fa020b7b2919d1728ed5999c6100040684dda0eb2f
                                                                                                                                                                      • Instruction ID: 86e289ecb8ab2a7c8c3be737a395d79cdeb77cb70afd16173f7dd18ab659cfbd
                                                                                                                                                                      • Opcode Fuzzy Hash: 24d633434489166fcc7434fa020b7b2919d1728ed5999c6100040684dda0eb2f
                                                                                                                                                                      • Instruction Fuzzy Hash: 16A2C171D002589FEF25CF68CC45BEDBBB1AF55304F148298E449A7282DB74AB85CF91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A70B10 Relevance: 2.0, Instructions: 1965COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: d97144d02a91213f5a0560d84e5730fd3814b8344f47ffd3a6e7334b682f5156
                                                                                                                                                                      • Instruction ID: ab5ebdaede949ab27fafeafac43b635d87f249fd78236726ee603f287560a48c
                                                                                                                                                                      • Opcode Fuzzy Hash: d97144d02a91213f5a0560d84e5730fd3814b8344f47ffd3a6e7334b682f5156
                                                                                                                                                                      • Instruction Fuzzy Hash: F003CD71D002588FDF28CF68CD95BEEBBB5AF45304F14C298E449AB292D7749A85CF90
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A5FE20 Relevance: 1.6, APIs: 1, Instructions: 103encryptionCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00A5FE58
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CryptDataUnprotect
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 834300711-0
                                                                                                                                                                      • Opcode ID: d5e8a9dc211904435613ab24cef08143dac18203a00577eae8df4966b2a0c1d2
                                                                                                                                                                      • Instruction ID: 3b024d2716ef276c3595a15b37d75115c17e50fcfe89720565f38555b96301d3
                                                                                                                                                                      • Opcode Fuzzy Hash: d5e8a9dc211904435613ab24cef08143dac18203a00577eae8df4966b2a0c1d2
                                                                                                                                                                      • Instruction Fuzzy Hash: 122128719083006BD604AB24DC46B6FB3E9BFD5725F404A6DFC8893291EB34E9498BD3
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B1B005 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindFirstFileExW.KERNELBASE(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,00AB298A,?,753523A0), ref: 00B1B020
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileFindFirst
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1974802433-0
                                                                                                                                                                      • Opcode ID: 0c04abbe255a925118c96969b36912746b87bb8080a0cd971d1b4e4a7c0bea01
                                                                                                                                                                      • Instruction ID: 018873eac128c3605b547624fc892820f3dc9dc9becc69828c40a0af34d2c33f
                                                                                                                                                                      • Opcode Fuzzy Hash: 0c04abbe255a925118c96969b36912746b87bb8080a0cd971d1b4e4a7c0bea01
                                                                                                                                                                      • Instruction Fuzzy Hash: 5CE08C72151108BEEB106F789C08CFB77DDEB093A0F104965BD64D20A0E6729DA19BA4
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A8DDF0 Relevance: 1.0, Instructions: 995COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: 4f6752384a7ebc28f1e19db1bd4e6486b03b31814a47dd5c98d611fab039a22e
                                                                                                                                                                      • Instruction ID: d517d92df99f903e423e90ddf69553299643661cb1dbea58337fbbcbd11c165a
                                                                                                                                                                      • Opcode Fuzzy Hash: 4f6752384a7ebc28f1e19db1bd4e6486b03b31814a47dd5c98d611fab039a22e
                                                                                                                                                                      • Instruction Fuzzy Hash: 86A2AF71D042999FCF15EBA8C959BDEBBB1AF56304F0441CCE44967382DB705B88CB92
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A92F90 Relevance: .3, Instructions: 334COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: b3f31e0643ecf9934d31296b457b5326847dddc5202f2361f4a49b11325603a1
                                                                                                                                                                      • Instruction ID: 34abec5be31f3bee2ae5673c2cb556f5c02323b1edbd958c223f55379ee7c446
                                                                                                                                                                      • Opcode Fuzzy Hash: b3f31e0643ecf9934d31296b457b5326847dddc5202f2361f4a49b11325603a1
                                                                                                                                                                      • Instruction Fuzzy Hash: FDE1D271E04288DFCF44DBA8C9857DEFBB5AF5A300F588099E449A7392DB309A44CF91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B2922D Relevance: .3, Instructions: 318COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2584b2d3249b359abeef2f55a8226345ce1ddb3a5b613329558240a733d32543
                                                                                                                                                                      • Instruction ID: 47c94e67cc10d9c7a6e817b34c097bb4767fc69efdea936c65f277d74eb204ea
                                                                                                                                                                      • Opcode Fuzzy Hash: 2584b2d3249b359abeef2f55a8226345ce1ddb3a5b613329558240a733d32543
                                                                                                                                                                      • Instruction Fuzzy Hash: A5B1C370A0062A9BCB39DE68E9956BEB7F1EF04300F14069ED4AE97691C7319E01CB55
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AAC170 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 519COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 12380 aac170-aac1b4 12381 aac1ba-aac252 12380->12381 12382 aac623-aac65c call ab4250 call aae350 12380->12382 12386 aac267-aac2a7 call aa7470 call aae7c0 12381->12386 12387 aac254-aac261 12381->12387 12393 aac7ec-aac7f0 12382->12393 12394 aac662-aac6f6 call aad6e0 call a48080 call aadd90 call ab56e0 12382->12394 12405 aac2a9-aac2bc 12386->12405 12406 aac2c6-aac2ee call ab3150 call aae350 12386->12406 12387->12386 12396 aac83d-aac842 12393->12396 12397 aac7f2-aac82f call aa7470 call aa3500 12393->12397 12431 aac6f8-aac704 12394->12431 12432 aac724-aac772 call b1dd74 * 2 12394->12432 12399 aac848 12396->12399 12400 aac544-aac556 12396->12400 12397->12400 12417 aac835 12397->12417 12409 aac850 call b21e70 12399->12409 12405->12406 12424 aac479-aac480 12406->12424 12425 aac2f4-aac388 call aad6e0 call a48080 call aadd90 call ab4210 12406->12425 12419 aac855 call b21e70 12409->12419 12417->12396 12427 aac85a-aac869 call b21e70 12419->12427 12428 aac559-aac55c 12424->12428 12429 aac486-aac4d1 call aa7470 call aa3500 * 2 12424->12429 12492 aac38a-aac396 12425->12492 12493 aac3b6-aac401 call b1dd74 * 2 12425->12493 12448 aac86b-aac875 12427->12448 12449 aac893-aac8a6 12427->12449 12436 aac59a-aac5ad call aa3500 12428->12436 12437 aac55e-aac595 call aa7470 call aa3500 12428->12437 12486 aac4d3-aac4e7 12429->12486 12487 aac4f1-aac50f call aa2c10 * 2 12429->12487 12438 aac71a-aac721 call b1cbd1 12431->12438 12439 aac706-aac714 12431->12439 12467 aac7a3-aac7c2 12432->12467 12468 aac774-aac783 12432->12468 12462 aac5af-aac5c3 12436->12462 12463 aac5cd-aac5eb call aa2c10 * 2 12436->12463 12437->12436 12438->12432 12439->12427 12439->12438 12456 aac889-aac88b call b1cbd1 12448->12456 12457 aac877-aac885 12448->12457 12470 aac890 12456->12470 12465 aac8a7-aac8af call b21e70 12457->12465 12466 aac887 12457->12466 12462->12463 12463->12400 12496 aac5f1-aac604 12463->12496 12466->12456 12467->12393 12477 aac7c4-aac7d0 12467->12477 12474 aac799-aac7a0 call b1cbd1 12468->12474 12475 aac785-aac793 12468->12475 12470->12449 12474->12467 12475->12427 12475->12474 12484 aac7e2-aac7e9 call b1cbd1 12477->12484 12485 aac7d2-aac7e0 12477->12485 12484->12393 12485->12427 12485->12484 12486->12487 12487->12400 12514 aac511-aac524 12487->12514 12499 aac398-aac3a6 12492->12499 12500 aac3ac-aac3b3 call b1cbd1 12492->12500 12516 aac42f-aac44b 12493->12516 12517 aac403-aac40f 12493->12517 12503 aac53a-aac541 call b1cbd1 12496->12503 12504 aac60a-aac618 12496->12504 12499->12409 12499->12500 12500->12493 12503->12400 12504->12419 12509 aac61e 12504->12509 12509->12503 12514->12503 12515 aac526-aac534 12514->12515 12515->12419 12515->12503 12516->12424 12520 aac44d-aac459 12516->12520 12518 aac411-aac41f 12517->12518 12519 aac425-aac42c call b1cbd1 12517->12519 12518->12409 12518->12519 12519->12516 12522 aac45b-aac469 12520->12522 12523 aac46f-aac476 call b1cbd1 12520->12523 12522->12409 12522->12523 12523->12424
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___std_exception_destroy.LIBVCRUNTIME ref: 00AAC3D6
                                                                                                                                                                      • ___std_exception_destroy.LIBVCRUNTIME ref: 00AAC3EF
                                                                                                                                                                      • ___std_exception_destroy.LIBVCRUNTIME ref: 00AAC747
                                                                                                                                                                      • ___std_exception_destroy.LIBVCRUNTIME ref: 00AAC760
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ___std_exception_destroy
                                                                                                                                                                      • String ID: value
                                                                                                                                                                      • API String ID: 4194217158-494360628
                                                                                                                                                                      • Opcode ID: d5de1a4955e09cc62d26232d9d17a6878d0be3451ae1540d6559c3e8629060e8
                                                                                                                                                                      • Instruction ID: 72e7b3bbf1eb077ba9be6da52bf365efc04958c5e6af54de6023a9cbbb2501bb
                                                                                                                                                                      • Opcode Fuzzy Hash: d5de1a4955e09cc62d26232d9d17a6878d0be3451ae1540d6559c3e8629060e8
                                                                                                                                                                      • Instruction Fuzzy Hash: B922D371D002588FEF18DFA8C8947EDFBB5AF59310F148299E449A7782DB746A84CF60
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A5DB60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99networkCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 12690 a5db60-a5db92 WSAStartup 12691 a5dc66-a5dc6f 12690->12691 12692 a5db98-a5dbc2 call a47d20 * 2 12690->12692 12697 a5dbc4-a5dbc8 12692->12697 12698 a5dbce-a5dc14 12692->12698 12697->12691 12697->12698 12700 a5dc16-a5dc1c 12698->12700 12701 a5dc60-a5dc65 12698->12701 12702 a5dc74-a5dc7e 12700->12702 12703 a5dc1e 12700->12703 12701->12691 12702->12701 12708 a5dc80-a5dc88 12702->12708 12704 a5dc24-a5dc38 socket 12703->12704 12704->12701 12707 a5dc3a-a5dc4a connect 12704->12707 12709 a5dc70 12707->12709 12710 a5dc4c-a5dc54 closesocket 12707->12710 12709->12702 12710->12704 12711 a5dc56-a5dc5a 12710->12711 12711->12701
                                                                                                                                                                      APIs
                                                                                                                                                                      • WSAStartup.WS2_32 ref: 00A5DB8A
                                                                                                                                                                      • socket.WS2_32(?,?,?,?,?,?,00B760D8,?,?), ref: 00A5DC2D
                                                                                                                                                                      • connect.WS2_32(00000000,?,?,?,?,?,00B760D8,?,?), ref: 00A5DC42
                                                                                                                                                                      • closesocket.WS2_32(00000000), ref: 00A5DC4D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Startupclosesocketconnectsocket
                                                                                                                                                                      • String ID: `4u
                                                                                                                                                                      • API String ID: 3098855095-6339388
                                                                                                                                                                      • Opcode ID: 2c7956b85ef65d3ca569b18ebfda963f912c1f9f54dd54cfb198b722f7dfd3d3
                                                                                                                                                                      • Instruction ID: 1659a0c7c6c95a7f3482473585257d6426a3ca961150c0315054f9802311b844
                                                                                                                                                                      • Opcode Fuzzy Hash: 2c7956b85ef65d3ca569b18ebfda963f912c1f9f54dd54cfb198b722f7dfd3d3
                                                                                                                                                                      • Instruction Fuzzy Hash: 6B31B0726043446BC6209B388C84A2FB7E5FB89725F141F1DF9A8A32E0E37199498692
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A4B890 Relevance: 4.9, APIs: 3, Instructions: 443COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 19452 a4b890-a4b8ed 19453 a4b8f4-a4b8ff 19452->19453 19453->19453 19454 a4b901-a4b922 call b22a20 19453->19454 19457 a4b924-a4b94c call b267f6 call b225ab call b267f6 19454->19457 19458 a4b98d-a4b994 19454->19458 19476 a4b961-a4b968 call aa8330 19457->19476 19477 a4b94e-a4b954 19457->19477 19460 a4b996-a4b9a2 19458->19460 19461 a4b9be-a4b9ce 19458->19461 19463 a4b9b4-a4b9bb call b1cbd1 19460->19463 19464 a4b9a4-a4b9b2 19460->19464 19463->19461 19464->19463 19466 a4b9cf-a4ba1d call b21e70 call aa9a50 19464->19466 19479 a4ba24-a4ba2f 19466->19479 19482 a4b96d 19476->19482 19480 a4b956 19477->19480 19481 a4b958-a4b95f 19477->19481 19479->19479 19483 a4ba31-a4ba52 call b22a20 19479->19483 19480->19481 19484 a4b970-a4b976 19481->19484 19482->19484 19491 a4ba54-a4ba7e call b267f6 call b225ab call b267f6 19483->19491 19492 a4baba-a4bac1 19483->19492 19485 a4b978 19484->19485 19486 a4b97a-a4b97f call b2b29f 19484->19486 19485->19486 19490 a4b984-a4b98a call b262a8 19486->19490 19490->19458 19511 a4ba90-a4ba97 call aa8330 19491->19511 19512 a4ba80-a4ba84 19491->19512 19495 a4bac3-a4bacf 19492->19495 19496 a4baeb-a4bafb 19492->19496 19499 a4bae1-a4bae8 call b1cbd1 19495->19499 19500 a4bad1-a4badf 19495->19500 19499->19496 19500->19499 19503 a4bafc-a4bb4d call b21e70 call aa9a50 19500->19503 19517 a4bb54-a4bb5f 19503->19517 19518 a4ba9c-a4baa2 19511->19518 19514 a4ba86 19512->19514 19515 a4ba88-a4ba8e 19512->19515 19514->19515 19515->19518 19517->19517 19519 a4bb61-a4bb82 call b22a20 19517->19519 19520 a4baa4 19518->19520 19521 a4baa6-a4baab call b2b29f 19518->19521 19526 a4bbf4-a4bbfb 19519->19526 19527 a4bb84-a4bbb8 call b267f6 call b225ab call b267f6 19519->19527 19520->19521 19525 a4bab0-a4bab9 call b262a8 19521->19525 19525->19492 19528 a4bc25-a4bc35 19526->19528 19529 a4bbfd-a4bc09 19526->19529 19546 a4bbca-a4bbd1 call aa8330 19527->19546 19547 a4bbba-a4bbbe 19527->19547 19532 a4bc1b-a4bc22 call b1cbd1 19529->19532 19533 a4bc0b-a4bc19 19529->19533 19532->19528 19533->19532 19536 a4bc36-a4bc4e call b21e70 19533->19536 19545 a4bc50-a4bc5b 19536->19545 19545->19545 19548 a4bc5d-a4bc7e call b22a20 19545->19548 19553 a4bbd6-a4bbdc 19546->19553 19549 a4bbc0 19547->19549 19550 a4bbc2-a4bbc8 19547->19550 19557 a4bc80-a4bc98 call b267f6 call b225ab call b262a8 19548->19557 19558 a4bc9b-a4bca2 19548->19558 19549->19550 19550->19553 19555 a4bbe0-a4bbeb call b2b29f call b262a8 19553->19555 19556 a4bbde 19553->19556 19574 a4bbf0-a4bbf3 19555->19574 19556->19555 19557->19558 19559 a4bca4-a4bcb0 19558->19559 19560 a4bccc-a4bcd2 19558->19560 19563 a4bcc2-a4bcc9 call b1cbd1 19559->19563 19564 a4bcb2-a4bcc0 19559->19564 19563->19560 19564->19563 19568 a4bcd3-a4bcfe call b21e70 19564->19568 19580 a4bd00-a4bd04 19568->19580 19581 a4bd0f-a4bd14 19568->19581 19574->19526 19580->19581 19582 a4bd06-a4bd0e 19580->19582
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __fread_nolock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2638373210-0
                                                                                                                                                                      • Opcode ID: a3a5776b62b7b6e70e4d3361d82cbea8fb3eac210e7e0d03c4f5c77cdf92696c
                                                                                                                                                                      • Instruction ID: 765c2f8122ab57cee623b03f48030e823696be96a9cbb9ea8364c85d91c59182
                                                                                                                                                                      • Opcode Fuzzy Hash: a3a5776b62b7b6e70e4d3361d82cbea8fb3eac210e7e0d03c4f5c77cdf92696c
                                                                                                                                                                      • Instruction Fuzzy Hash: F0D14C70A10204ABEB18DF68DC86BAF77F9EF85710F20456DF80997682D7B4DA41C7A0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A544F0 Relevance: 4.8, APIs: 3, Instructions: 331fileCOMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 19583 a544f0-a5454e 19584 a54555-a5455a 19583->19584 19584->19584 19585 a5455c-a5458f call a42810 19584->19585 19588 a54590-a54595 19585->19588 19588->19588 19589 a54597-a5460a call a42810 call a4c3e0 call a4c740 19588->19589 19596 a54610-a54615 19589->19596 19596->19596 19597 a54617-a54622 19596->19597 19598 a54902 call a42040 19597->19598 19599 a54628-a546ba call aad420 call aad230 call aa57e0 19597->19599 19602 a54907 call b21e70 19598->19602 19613 a546bc-a546c8 19599->19613 19614 a546e8-a54704 19599->19614 19606 a5490c-a5490d call b1bb7b 19602->19606 19610 a54912-a54917 call b21e70 19606->19610 19618 a546de-a546e5 call b1cbd1 19613->19618 19619 a546ca-a546d8 19613->19619 19615 a54735-a5473f 19614->19615 19616 a54706-a54715 19614->19616 19623 a54741-a5474d 19615->19623 19624 a5476d-a54796 CopyFileA 19615->19624 19621 a54717-a54725 19616->19621 19622 a5472b-a54732 call b1cbd1 19616->19622 19618->19614 19619->19602 19619->19618 19621->19602 19621->19622 19622->19615 19627 a54763-a5476a call b1cbd1 19623->19627 19628 a5474f-a5475d 19623->19628 19629 a547cf-a547de call b1bed2 19624->19629 19630 a54798-a547b6 call a4ab50 CopyFileA 19624->19630 19627->19624 19628->19602 19628->19627 19629->19606 19639 a547e4-a547f7 call b1a450 19629->19639 19630->19629 19638 a547b8-a547c0 call b1a450 19630->19638 19642 a547c5-a547ca 19638->19642 19643 a547fc-a54824 call aa5a60 19639->19643 19644 a548a3-a548a9 19642->19644 19652 a54826-a54850 19643->19652 19653 a54852-a5485f call ab2140 19643->19653 19646 a548d3-a54901 call aa7c60 19644->19646 19647 a548ab-a548b7 19644->19647 19650 a548c9-a548d0 call b1cbd1 19647->19650 19651 a548b9-a548c7 19647->19651 19650->19646 19651->19610 19651->19650 19656 a54862-a54865 19652->19656 19653->19656 19659 a54867-a54876 19656->19659 19660 a54896-a548a0 call b1bee3 19656->19660 19662 a5488c-a54893 call b1cbd1 19659->19662 19663 a54878-a54886 19659->19663 19660->19644 19662->19660 19663->19610 19663->19662
                                                                                                                                                                      APIs
                                                                                                                                                                      • CopyFileA.KERNEL32(?,?,00000000,?,?,?,?,?), ref: 00A5478E
                                                                                                                                                                      • CopyFileA.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?), ref: 00A547AE
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A5489B
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CopyFile$Mtx_unlock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 741997458-0
                                                                                                                                                                      • Opcode ID: 703fa9d58feed1189f345f175e867d84e1b43b0a43fa0820c28ec54986d4710b
                                                                                                                                                                      • Instruction ID: c1091c710bbb85eeaa4d335437d293b5119869887ead70fb6dae22cef5ee0edf
                                                                                                                                                                      • Opcode Fuzzy Hash: 703fa9d58feed1189f345f175e867d84e1b43b0a43fa0820c28ec54986d4710b
                                                                                                                                                                      • Instruction Fuzzy Hash: 17C10971D002089FDF08DFA8CD45BEEBBB5FF45304F148258E815A7692E7746A89CB90
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B31CE3 Relevance: 3.3, APIs: 2, Instructions: 297COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 22500 b31ce3-b31cf3 22501 b31cf5-b31d08 call b2a8ec call b2a8ff 22500->22501 22502 b31d0d-b31d0f 22500->22502 22518 b32067 22501->22518 22504 b31d15-b31d1b 22502->22504 22505 b3204f-b3205c call b2a8ec call b2a8ff 22502->22505 22504->22505 22507 b31d21-b31d4a 22504->22507 22521 b32062 call b21e60 22505->22521 22507->22505 22510 b31d50-b31d59 22507->22510 22513 b31d73-b31d75 22510->22513 22514 b31d5b-b31d6e call b2a8ec call b2a8ff 22510->22514 22516 b3204b-b3204d 22513->22516 22517 b31d7b-b31d7f 22513->22517 22514->22521 22523 b3206a-b3206d 22516->22523 22517->22516 22522 b31d85-b31d89 22517->22522 22518->22523 22521->22518 22522->22514 22526 b31d8b-b31da2 22522->22526 22528 b31dd7-b31ddd 22526->22528 22529 b31da4-b31da7 22526->22529 22533 b31db1-b31dc8 call b2a8ec call b2a8ff call b21e60 22528->22533 22534 b31ddf-b31de6 22528->22534 22531 b31da9-b31daf 22529->22531 22532 b31dcd-b31dd5 22529->22532 22531->22532 22531->22533 22536 b31e4a-b31e69 22532->22536 22565 b31f82 22533->22565 22537 b31dea-b31e08 call b344ed call b34473 * 2 22534->22537 22538 b31de8 22534->22538 22539 b31f25-b31f2e call b3e404 22536->22539 22540 b31e6f-b31e7b 22536->22540 22568 b31e25-b31e48 call b2b7fd 22537->22568 22569 b31e0a-b31e20 call b2a8ff call b2a8ec 22537->22569 22538->22537 22554 b31f30-b31f42 22539->22554 22555 b31f9f 22539->22555 22540->22539 22543 b31e81-b31e83 22540->22543 22543->22539 22547 b31e89-b31eaa 22543->22547 22547->22539 22551 b31eac-b31ec2 22547->22551 22551->22539 22557 b31ec4-b31ec6 22551->22557 22554->22555 22560 b31f44-b31f53 22554->22560 22556 b31fa3-b31fb9 ReadFile 22555->22556 22561 b32017-b32022 22556->22561 22562 b31fbb-b31fc1 22556->22562 22557->22539 22563 b31ec8-b31eeb 22557->22563 22560->22555 22572 b31f55-b31f59 22560->22572 22580 b32024-b32036 call b2a8ff call b2a8ec 22561->22580 22581 b3203b-b3203e 22561->22581 22562->22561 22566 b31fc3 22562->22566 22563->22539 22567 b31eed-b31f03 22563->22567 22570 b31f85-b31f8f call b34473 22565->22570 22574 b31fc6-b31fd8 22566->22574 22567->22539 22575 b31f05-b31f07 22567->22575 22568->22536 22569->22565 22570->22523 22572->22556 22579 b31f5b-b31f73 22572->22579 22574->22570 22582 b31fda-b31fde 22574->22582 22575->22539 22583 b31f09-b31f20 22575->22583 22600 b31f75-b31f7a 22579->22600 22601 b31f94-b31f9d 22579->22601 22580->22565 22590 b32044-b32046 22581->22590 22591 b31f7b-b31f81 call b2a8a5 22581->22591 22588 b31fe0-b31ff0 call b319f5 22582->22588 22589 b31ff7-b32004 22582->22589 22583->22539 22608 b31ff3-b31ff5 22588->22608 22597 b32010-b32015 call b3183b 22589->22597 22598 b32006 call b31b4c 22589->22598 22590->22570 22591->22565 22609 b3200b-b3200e 22597->22609 22598->22609 22600->22591 22601->22574 22608->22570 22609->22608
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 6f9a159e768d54d33863b3c4d915e14c96e89b3afad9fca809b259589b57fdde
                                                                                                                                                                      • Instruction ID: c83837f604b23b807bf589b055b212bd0cd584a12d11e05ad5f9852a89d22a45
                                                                                                                                                                      • Opcode Fuzzy Hash: 6f9a159e768d54d33863b3c4d915e14c96e89b3afad9fca809b259589b57fdde
                                                                                                                                                                      • Instruction Fuzzy Hash: EBB1D074A04249AFDB15DFACD881BAD7BF9FF49300F2445E9E4059B292CB70AD42CB61
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A54920 Relevance: 3.1, APIs: 2, Instructions: 127COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 22612 a54920-a5493a call b1bed2 22615 a54940-a54966 22612->22615 22616 a54a83-a54a89 call b1bb7b 22612->22616 22617 a5499c-a549ab call b1bee3 call b19a90 22615->22617 22618 a54968-a5496a 22615->22618 22628 a549b0-a549b6 22617->22628 22621 a54970-a54974 22618->22621 22624 a549b7-a549dc call b19a90 22621->22624 22625 a54976-a5499a 22621->22625 22630 a549e0-a549e1 call b2645e 22624->22630 22631 a549de 22624->22631 22625->22617 22625->22621 22633 a549e6-a549fc 22630->22633 22631->22630 22634 a54a1e-a54a24 22633->22634 22635 a549fe 22633->22635 22636 a54a26-a54a30 22634->22636 22637 a54a4e-a54a7d call b1bee3 22634->22637 22638 a54a00-a54a16 call aa58e0 22635->22638 22639 a54a44-a54a4b call b1cbd1 22636->22639 22640 a54a32-a54a40 22636->22640 22650 a54a18 22638->22650 22639->22637 22643 a54a42 22640->22643 22644 a54a7e call b21e70 22640->22644 22643->22639 22644->22616 22650->22634
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1418687624-0
                                                                                                                                                                      • Opcode ID: 1d5463333667c47153f52d635e4219f91e17e4789b285f5f01a9b8688c14d0d8
                                                                                                                                                                      • Instruction ID: 65e77714a1f875de1076ca969744895145d2f96696ec9445482a6235f72ae7f1
                                                                                                                                                                      • Opcode Fuzzy Hash: 1d5463333667c47153f52d635e4219f91e17e4789b285f5f01a9b8688c14d0d8
                                                                                                                                                                      • Instruction Fuzzy Hash: 29312A72E001108BDB1CEF68DCC56AE77A2BB44345B04417DE90A9B392EA3699C8C7D0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A4BF40 Relevance: 3.1, APIs: 2, Instructions: 62COMMON
                                                                                                                                                                      Download Yara Rule

                                                                                                                                                                      Control-flow Graph

                                                                                                                                                                      • Executed
                                                                                                                                                                      • Not Executed
                                                                                                                                                                      control_flow_graph 22651 a4bf40-a4bf57 call b1bed2 22654 a4bfae-a4bfb4 call b1bb7b 22651->22654 22655 a4bf59-a4bf5b 22651->22655 22657 a4bf97 22655->22657 22658 a4bf5d-a4bf5f 22655->22658 22661 a4bf99-a4bfad call b1bee3 22657->22661 22660 a4bf62-a4bf67 22658->22660 22660->22660 22662 a4bf69-a4bf6b 22660->22662 22662->22657 22664 a4bf6d-a4bf77 GetFileAttributesA 22662->22664 22666 a4bf93-a4bf95 22664->22666 22667 a4bf79-a4bf82 22664->22667 22666->22661 22667->22666 22669 a4bf84-a4bf87 22667->22669 22669->22666 22670 a4bf89-a4bf8c 22669->22670 22670->22666 22671 a4bf8e-a4bf91 22670->22671 22671->22657 22671->22666
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetFileAttributesA.KERNEL32(?,?,BEBEA9B5), ref: 00A4BF6E
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A4BF9E
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AttributesFileMtx_unlock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1424188087-0
                                                                                                                                                                      • Opcode ID: 885c10b7c00097a84a0d7dc9c2b1faea629e5e6658c045efdadf1de5a454603f
                                                                                                                                                                      • Instruction ID: 63d73b80809401b4f62e056722a9ca338cba707111e2327d4028f68244b2e709
                                                                                                                                                                      • Opcode Fuzzy Hash: 885c10b7c00097a84a0d7dc9c2b1faea629e5e6658c045efdadf1de5a454603f
                                                                                                                                                                      • Instruction Fuzzy Hash: 32F081695666001D0D3413381C858FE37088BD33247144A75E80FC7552E703CC8D4AF3
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A4BFC0 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateDirectoryA.KERNEL32(?,00000000,00000000,?,BEBEA9B5), ref: 00A4BFD6
                                                                                                                                                                      • __Mtx_unlock.LIBCPMT ref: 00A4BFE3
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateDirectoryMtx_unlock
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3577089425-0
                                                                                                                                                                      • Opcode ID: 612c860df36a3625dba2ad0b587dac214755dd9ef6d24f151245a7c2f12981f9
                                                                                                                                                                      • Instruction ID: 75810b950d6c1b14e2bbb0a97c998471e5512b8f4d76ed58071c3c6b9edad47b
                                                                                                                                                                      • Opcode Fuzzy Hash: 612c860df36a3625dba2ad0b587dac214755dd9ef6d24f151245a7c2f12981f9
                                                                                                                                                                      • Instruction Fuzzy Hash: 67D0A9A3E8422023A9B032B42C0ACEB29884A20360B4548F0FE0CC2652FB48CCC402E2
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B34E29 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • DeleteFileW.KERNEL32(?,?,00B264B1,?), ref: 00B34E31
                                                                                                                                                                      • __dosmaperr.LIBCMT ref: 00B34E42
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: DeleteFile__dosmaperr
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1911827773-0
                                                                                                                                                                      • Opcode ID: d5c051f950768f98db0f4f3524697d6e9f59bf6cb6eb66651efeb91a28360cc9
                                                                                                                                                                      • Instruction ID: cb2013d642a39ab009e784579a3eb6d9a93923835b0e31bc23935144b34c98f1
                                                                                                                                                                      • Opcode Fuzzy Hash: d5c051f950768f98db0f4f3524697d6e9f59bf6cb6eb66651efeb91a28360cc9
                                                                                                                                                                      • Instruction Fuzzy Hash: C4D01232187118665A1435F67C0D857379E9BC23747211A65F42C851D1DF22D8914151
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AA3560 Relevance: 1.7, APIs: 1, Instructions: 246COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00AA386A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: dc94888780fa4070f558db19e3c6e5fa9be4cd459c08387047d671a8fdb417a8
                                                                                                                                                                      • Instruction ID: faa4c10827cbbeb42d9838aeffa9d90cf76775a4992aef32806a2a17ccf00879
                                                                                                                                                                      • Opcode Fuzzy Hash: dc94888780fa4070f558db19e3c6e5fa9be4cd459c08387047d671a8fdb417a8
                                                                                                                                                                      • Instruction Fuzzy Hash: 49B13AB5D012059FCB00CF68C484799FBF4BF4A714F28C1AEE459AB392D775AA41CB90
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B32B5C Relevance: 1.7, APIs: 1, Instructions: 198fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • WriteFile.KERNEL32(?,00000000,00B26747,?,00000000,00000000,00000000,?,00000000,?,00B1BC71,00B26747,00000000,00B1BC71,?,?), ref: 00B32CE1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileWrite
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3934441357-0
                                                                                                                                                                      • Opcode ID: a911b6e1c7faf5b58826f1616d1deb828af6528e46e201acae17d4e5cbeeec65
                                                                                                                                                                      • Instruction ID: 68066820a1ee52c21379f90ce83bc173e614f421390ffc12a9a571c4af162efa
                                                                                                                                                                      • Opcode Fuzzy Hash: a911b6e1c7faf5b58826f1616d1deb828af6528e46e201acae17d4e5cbeeec65
                                                                                                                                                                      • Instruction Fuzzy Hash: E161BE71D0411AAFDF15CFA8C884AEEBBF9EF09304F6401D9E904AB256D772D901DBA0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B22002 Relevance: 1.7, APIs: 1, Instructions: 157COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: c41d6343e26e878311e11559019128bdc6f0dbc57e7764ec3c1731cf86550ce5
                                                                                                                                                                      • Instruction ID: f87da4f81de99b5cac111c601e4367a17c35179416ef9d195b046f69d08c51cc
                                                                                                                                                                      • Opcode Fuzzy Hash: c41d6343e26e878311e11559019128bdc6f0dbc57e7764ec3c1731cf86550ce5
                                                                                                                                                                      • Instruction Fuzzy Hash: 46519070A00218BFDB14CF58DC85EAA7BF1EF89364F248199F90DAB252D3719E51DB90
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AA7C60 Relevance: 1.6, APIs: 1, Instructions: 150COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • std::locale::_Init.LIBCPMT ref: 00AA7D96
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Initstd::locale::_
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1620887387-0
                                                                                                                                                                      • Opcode ID: 550f3dc0583b63ab7888bacf13adc036796bd8f995b42da5cc0397bab52a62d9
                                                                                                                                                                      • Instruction ID: c9885b35f564de51934a6c25c23b99c73f711adf309dbeca8ed89dc618a2c9be
                                                                                                                                                                      • Opcode Fuzzy Hash: 550f3dc0583b63ab7888bacf13adc036796bd8f995b42da5cc0397bab52a62d9
                                                                                                                                                                      • Instruction Fuzzy Hash: AA51BDB1600601AFE714DF18C999B5AFBF1FF85314F148269E8098BB81D7B5E964CBD0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AB2360 Relevance: 1.6, APIs: 1, Instructions: 138COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00AB24A4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: 98f2bbfaa17611ac6c4cf53b285d33ec12dbd402c032722d3a9a35f4b7867558
                                                                                                                                                                      • Instruction ID: 854d1f2b0ceae28c3718f40929dee7ac038fc39ef631b3e0339338a004695ddf
                                                                                                                                                                      • Opcode Fuzzy Hash: 98f2bbfaa17611ac6c4cf53b285d33ec12dbd402c032722d3a9a35f4b7867558
                                                                                                                                                                      • Instruction Fuzzy Hash: 2141E471A005019FD718DF68CD859AEB7A8EB49310754472AFC25C7786E730EE96C790
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AAB6B0 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00AAB801
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: 110215cb280c8d6d82a99f77a2bb04b97505f1aac0e0b226b2c8499bf2a13dfa
                                                                                                                                                                      • Instruction ID: 825c89803b267e7628744dda3b3516abbbd4a745c6b625a0483dcb1240bdffb9
                                                                                                                                                                      • Opcode Fuzzy Hash: 110215cb280c8d6d82a99f77a2bb04b97505f1aac0e0b226b2c8499bf2a13dfa
                                                                                                                                                                      • Instruction Fuzzy Hash: DC4113729001189BCB05DF6CDC806AEBBE5AF8A350F5402A9F819EB382D770DE5187E1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AA5A60 Relevance: 1.6, APIs: 1, Instructions: 130COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00AA5B47
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: aeb284ed20ca9465df832e9ca565a1a04fa20922b66df8adb3dbc1d924e5fbc1
                                                                                                                                                                      • Instruction ID: 5a3afc9276a9c97b2e93da1205d36ef10488ec6fcb5859e36c98ff5fc8861d71
                                                                                                                                                                      • Opcode Fuzzy Hash: aeb284ed20ca9465df832e9ca565a1a04fa20922b66df8adb3dbc1d924e5fbc1
                                                                                                                                                                      • Instruction Fuzzy Hash: 92314872E006159FC7149F38E480AA9B7A8EF52361F10427AF8158B2D2E731ED94C7F4
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A42A50 Relevance: 1.6, APIs: 1, Instructions: 125COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00A42B87
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: ee8d8d920fb609d505e386b06ef18c5d213431c305b6b6999d44565d3b3fe67b
                                                                                                                                                                      • Instruction ID: d62580727d3064857083b2d4a605a4d84077b465918cc530d8b09b6bc13d9834
                                                                                                                                                                      • Opcode Fuzzy Hash: ee8d8d920fb609d505e386b06ef18c5d213431c305b6b6999d44565d3b3fe67b
                                                                                                                                                                      • Instruction Fuzzy Hash: 6241F676A000019FD718DF6CCD85A6DBBA9EBD535079482A9F819CB345DA30ED4287A0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A428F0 Relevance: 1.6, APIs: 1, Instructions: 123COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00A42A22
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: eb80d5c4d4e2446ae9cf4eb226aa7c3f3f34e6043755dc41d9d59fbebaa61357
                                                                                                                                                                      • Instruction ID: c2308967707abe5aa81707a44ec168f744deeeb9c6b800467693876f7beb964d
                                                                                                                                                                      • Opcode Fuzzy Hash: eb80d5c4d4e2446ae9cf4eb226aa7c3f3f34e6043755dc41d9d59fbebaa61357
                                                                                                                                                                      • Instruction Fuzzy Hash: 0D415876A002049BC716DF68D8806AEBBA1EBC4350F9442B9FC18DB342D630DE51C7E1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B262D8 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: __dosmaperr
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2332233096-0
                                                                                                                                                                      • Opcode ID: 52370859ef69b3f4617fb24f5ced4fe9396486e19b9b84d61a2c6e9b580ec177
                                                                                                                                                                      • Instruction ID: 812536c3b54b4bfba0a17605dce59d502ec324e7b476dbca1c964664f755066b
                                                                                                                                                                      • Opcode Fuzzy Hash: 52370859ef69b3f4617fb24f5ced4fe9396486e19b9b84d61a2c6e9b580ec177
                                                                                                                                                                      • Instruction Fuzzy Hash: 9821DA31A00621ABDB21EF29AD01A5BB7E5EF91370F214699F82D97291E730EC5187D4
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B321D2 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindCloseChangeNotification.KERNEL32(00000000,00000000,CF830579,?,00B320B9,00000000,CF830579,00B71090,0000000C,00B32175,00B2627D,?), ref: 00B32228
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ChangeCloseFindNotification
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2591292051-0
                                                                                                                                                                      • Opcode ID: d98242622a10b49a09d0760e5ba362cf1669e287c525c4b8d78eabd8365bcd4e
                                                                                                                                                                      • Instruction ID: 635f798ca3a70118888d36646d7968b28b7e5b85b90b48b4aa95f9ebde062219
                                                                                                                                                                      • Opcode Fuzzy Hash: d98242622a10b49a09d0760e5ba362cf1669e287c525c4b8d78eabd8365bcd4e
                                                                                                                                                                      • Instruction Fuzzy Hash: DB11263364922426C6352778AD45B7F77C9CF83734F3602E9FA19AB1D2DEB19C814190
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B2B71C Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • SetFilePointerEx.KERNEL32(00000000,00000000,00B70D48,00B1BC71,00000002,00B1BC71,00000000,?,?,?,00B2B826,00000000,?,00B1BC71,00000002,00B70D48), ref: 00B2B758
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FilePointer
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 973152223-0
                                                                                                                                                                      • Opcode ID: c4e072d4dd318f7df6d717765c695421303d5ab953a5bc4e3ded81eef062a173
                                                                                                                                                                      • Instruction ID: 5b48b226324e8f2fa65419d17566f1fbe9bbee885994ddf9d1f1441ba6cfe3ca
                                                                                                                                                                      • Opcode Fuzzy Hash: c4e072d4dd318f7df6d717765c695421303d5ab953a5bc4e3ded81eef062a173
                                                                                                                                                                      • Instruction Fuzzy Hash: 6301D632610525AFCF198F59EC45C9E3BAADBC5320F340298F8159B2E1EF71ED419B90
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B1C950 Relevance: 1.6, APIs: 1, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___std_exception_copy.LIBVCRUNTIME ref: 00A41FDE
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ___std_exception_copy
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2659868963-0
                                                                                                                                                                      • Opcode ID: 18e13be459ea68c58c1c1a8cfeede11b48eeb04d32194101f1b1c8c851777cd7
                                                                                                                                                                      • Instruction ID: 9cc256aaebc47be57d310dab661109bbdacaab610a6ec661f4ae742989a1947c
                                                                                                                                                                      • Opcode Fuzzy Hash: 18e13be459ea68c58c1c1a8cfeede11b48eeb04d32194101f1b1c8c851777cd7
                                                                                                                                                                      • Instruction Fuzzy Hash: 4701493640030DA7CB15AFA8EC018C97BECDE013A0B9086B2F918EA491FB70E9D487D1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B33AB3 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000008,00B1ADBC,?,?,00B33439,00000001,00000364,?,00000006,000000FF,?,00B1DD3B,?,?,?,?), ref: 00B33AF4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                      • Opcode ID: 3ae679414f8537be963ec49b2d39625ddd7854ebcd96b88db9d29ab8986b5e0f
                                                                                                                                                                      • Instruction ID: 4162f76a750a2b0ef70c38c0f3d5678a8acbcd8bb08f0bb60369730796151bc6
                                                                                                                                                                      • Opcode Fuzzy Hash: 3ae679414f8537be963ec49b2d39625ddd7854ebcd96b88db9d29ab8986b5e0f
                                                                                                                                                                      • Instruction Fuzzy Hash: CBF0E932605624669B216A269C42B5F7BC8DF41F60F3981D1E848EA090DB70DE0082E1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AAE760 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00AAE7B4
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Concurrency::cancel_current_task
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 118556049-0
                                                                                                                                                                      • Opcode ID: 393c8228fc42c294f7e44c6a3400c392173ea9dffd8f537167bb49981e5da995
                                                                                                                                                                      • Instruction ID: 1339afd6fadf4c4c32ccbebacc1674c881964d1fd0a0ce0573eed747332f12e7
                                                                                                                                                                      • Opcode Fuzzy Hash: 393c8228fc42c294f7e44c6a3400c392173ea9dffd8f537167bb49981e5da995
                                                                                                                                                                      • Instruction Fuzzy Hash: AEF05CB20001080EE718E3B0A546C6E77C8CF613D0B404477F81AC75D2FB35EDA9C166
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B344ED Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlAllocateHeap.NTDLL(00000000,?,?,?,00B1DD3B,?,?,?,?,?,00A42D8D,00B1ADBC,?,?,00B1ADBC), ref: 00B34520
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: AllocateHeap
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1279760036-0
                                                                                                                                                                      • Opcode ID: 80a227fb96ffa61a4bb7de8e491f9f04116c434c964f36a6c6c8476659da1018
                                                                                                                                                                      • Instruction ID: ceae5265595518929be1f41f2f5474b8777a398649469b33f92d760300fa3306
                                                                                                                                                                      • Opcode Fuzzy Hash: 80a227fb96ffa61a4bb7de8e491f9f04116c434c964f36a6c6c8476659da1018
                                                                                                                                                                      • Instruction Fuzzy Hash: 7BE09231E0122167EA213A695C11B6B7ACDDFA63B1F7705E2ED1896090DB60ED4081E2
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B1B2D7 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • CreateFileW.KERNELBASE(?,?,00000007,00000000,00000003,?,00000000,?,?,00B1B1F9,?,?,00000080,?,?,?), ref: 00B1B2EC
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: CreateFile
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 823142352-0
                                                                                                                                                                      • Opcode ID: 59560aeff52943d103f78f4283938e5736aad6a396c62c508aa233dd689fca14
                                                                                                                                                                      • Instruction ID: 9f1646fdd02f8a6dfd9547d2b798ee42ce09be77459598265ecfd54d5938663d
                                                                                                                                                                      • Opcode Fuzzy Hash: 59560aeff52943d103f78f4283938e5736aad6a396c62c508aa233dd689fca14
                                                                                                                                                                      • Instruction Fuzzy Hash: 01E086312422287BCB215EB5EC08ED73F69EF067B0F004214FA18A71D0C2314920D7D0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B34473 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • RtlFreeHeap.NTDLL(00000000,00000000,?,00B3C369,?,00000000,?,?,00B3C60A,?,00000007,?,?,00B3CAFE,?,?), ref: 00B3448A
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FreeHeap
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 3298025750-0
                                                                                                                                                                      • Opcode ID: 84e651817496184d940a60a70b45afa1ecd5f17faa2b7923f76374a1f78e7843
                                                                                                                                                                      • Instruction ID: 71782c368f4ebe2815a26dfc936d579d6884841acd3d16b64adaa91231963833
                                                                                                                                                                      • Opcode Fuzzy Hash: 84e651817496184d940a60a70b45afa1ecd5f17faa2b7923f76374a1f78e7843
                                                                                                                                                                      • Instruction Fuzzy Hash: 2FE0C2316013546ACB217BBAA808B9976D9DB41BA0F2088A1FB0C9F150EF709C908391
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B2C7E9 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ExitProcess.KERNEL32(?,?,00B2C7E3,00000016,00B21C63,?,?,F2D553D1,00B21C63,?), ref: 00B2C813
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ExitProcess
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 621844428-0
                                                                                                                                                                      • Opcode ID: 813612186b0026c63221de89adaee09e0bd48038463fdb344b3ad0f908cf5e6c
                                                                                                                                                                      • Instruction ID: de5d723f13092c8f3e78801ad9af97424f7beeffc17c02d3501298368335f3b4
                                                                                                                                                                      • Opcode Fuzzy Hash: 813612186b0026c63221de89adaee09e0bd48038463fdb344b3ad0f908cf5e6c
                                                                                                                                                                      • Instruction Fuzzy Hash: E8D0C920182219BECE253FA0EC19CED3FAAAF813A0F50E461BC6C0F175CF71995295D1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B1AFC4 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • FindNextFileW.KERNELBASE(?,?,?,00A4646F,?,?,?,?,?,?,00B60624,00000001), ref: 00B1AFCD
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: FileFindNext
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 2029273394-0
                                                                                                                                                                      • Opcode ID: f470f374b341c45ebfa4d3b892d5099b15fb36e94c2924f042f4cee644eef24c
                                                                                                                                                                      • Instruction ID: 5547b8368701627278c6d32078d09b4cf32a887a93b69b4591fadfe3cd66660b
                                                                                                                                                                      • Opcode Fuzzy Hash: f470f374b341c45ebfa4d3b892d5099b15fb36e94c2924f042f4cee644eef24c
                                                                                                                                                                      • Instruction Fuzzy Hash: 49C0803114310D754B013E73AC048E577D95B513907509021BD05D5021D532D4A166A6
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Non-executed Functions

                                                                                                                                                                      Function 00ACB800 Relevance: 18.5, APIs: 3, Strings: 7, Instructions: 970COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: $+$+Inf$-Inf$Inf$NaN$gfff
                                                                                                                                                                      • API String ID: 0-2577472133
                                                                                                                                                                      • Opcode ID: e1c8ce4fc7c0164b933e9140c2ae18b15df2669142ce592003532870db61d2ce
                                                                                                                                                                      • Instruction ID: 7304ab6610a905a52a33388b22bd8c66c77f9c4c02c9d02f3bb1a4e9caa98d3d
                                                                                                                                                                      • Opcode Fuzzy Hash: e1c8ce4fc7c0164b933e9140c2ae18b15df2669142ce592003532870db61d2ce
                                                                                                                                                                      • Instruction Fuzzy Hash: 2582D03190CB808FD725CF288551B6BBBE1AFCA344F098A5DF8CAAB251D771C945CB52
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A5A100 Relevance: 4.8, Strings: 2, Instructions: 2287COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: %s|%s$type must be boolean, but is
                                                                                                                                                                      • API String ID: 0-1040836419
                                                                                                                                                                      • Opcode ID: da111beca0d26c470197b310a3c16c277f51e1f25cc830f2d91655755bf4ced4
                                                                                                                                                                      • Instruction ID: faaca128ee30043a0c30bb3dc3a7eed5cba41d8a054e0659c2675a86c1055209
                                                                                                                                                                      • Opcode Fuzzy Hash: da111beca0d26c470197b310a3c16c277f51e1f25cc830f2d91655755bf4ced4
                                                                                                                                                                      • Instruction Fuzzy Hash: AE23F370D002588FDB15DF68C959BEEBBB0BF06305F1481D9D849AB292D7719E88CFA1
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A9A180 Relevance: 3.5, APIs: 2, Instructions: 530COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Mtx_unlock$AttributesCreateDirectoryFile
                                                                                                                                                                      • String ID: Y
                                                                                                                                                                      • API String ID: 3883471643-4136946213
                                                                                                                                                                      • Opcode ID: 363551c4dc389b2dc0cd884725c81a80b2499ffa6e0967cc26577ffa308bdb9b
                                                                                                                                                                      • Instruction ID: f6fa67704b88c31d0807063386a37f2a5cacf966af95835a8ddf530f8ad59072
                                                                                                                                                                      • Opcode Fuzzy Hash: 363551c4dc389b2dc0cd884725c81a80b2499ffa6e0967cc26577ffa308bdb9b
                                                                                                                                                                      • Instruction Fuzzy Hash: 3922F470A002588FDF25DB68C9587EEBBF4AF26304F1441DAD449AB292D7745F88CF92
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00ACD9B0 Relevance: 3.5, APIs: 2, Instructions: 465COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00ACDD53
                                                                                                                                                                      • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00ACDDB1
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 885266447-0
                                                                                                                                                                      • Opcode ID: 086e33687cae15f893c2e33f16c08bb88a17c1d94da123d815873158ab0c4de2
                                                                                                                                                                      • Instruction ID: 05e1b7dfda9fa41a0a38456da02ab83ee9c8a1d30150ce6d72b36ff3b86cc722
                                                                                                                                                                      • Opcode Fuzzy Hash: 086e33687cae15f893c2e33f16c08bb88a17c1d94da123d815873158ab0c4de2
                                                                                                                                                                      • Instruction Fuzzy Hash: 3E02E371E046198BCF18CF6CD890BBDFBB1AF95310F1A82AED859AB381DB748941C750
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00B1C92A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • GetSystemTimePreciseAsFileTime.KERNEL32(?,00B1C338,?,?,?,?,00A54A9B,?,00A5F03C), ref: 00B1C943
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: Time$FilePreciseSystem
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID: 1802150274-0
                                                                                                                                                                      • Opcode ID: 4d09fa8ed3be2752be218365d4a373df735f69a716c9ce71ee47aabb48205882
                                                                                                                                                                      • Instruction ID: d5d403a5c3eace266239179b505a480f017cdcbc1c312e47532f6602a7611383
                                                                                                                                                                      • Opcode Fuzzy Hash: 4d09fa8ed3be2752be218365d4a373df735f69a716c9ce71ee47aabb48205882
                                                                                                                                                                      • Instruction Fuzzy Hash: 34D02232A8213C938F122B98FC04AACBFC8FA41FE03444061E80E23120CEA09C408BD9
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00ABF0A0 Relevance: 1.5, Strings: 1, Instructions: 251COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Strings
                                                                                                                                                                      • Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36, xrefs: 00ABF143
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                                                                                                                                                                      • API String ID: 0-383447037
                                                                                                                                                                      • Opcode ID: bee2c70b4b4ef41f70954c3a5dfa738ad977e137e14bfee338f7f24f7a47c8a0
                                                                                                                                                                      • Instruction ID: 618b90df39503be90c1189efc3ae4f9561b9c1fb9aa6ced341cfc2403760ab0d
                                                                                                                                                                      • Opcode Fuzzy Hash: bee2c70b4b4ef41f70954c3a5dfa738ad977e137e14bfee338f7f24f7a47c8a0
                                                                                                                                                                      • Instruction Fuzzy Hash: 53B1E270C143888EDB15CFA8D845BEEBBF8EF1E308F14016ED845A7652E7B45588CB69
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00AC4870 Relevance: .7, Instructions: 744COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 5a8c0c3db95f51c5bfa2536f5c3add5433c7be915c0757840d8bb8629914f1c8
                                                                                                                                                                      • Instruction ID: 89fed3b1cd8ebf3d0a1ed0e9622b3ae423056d8edd654c6399e76c77fb7f15ee
                                                                                                                                                                      • Opcode Fuzzy Hash: 5a8c0c3db95f51c5bfa2536f5c3add5433c7be915c0757840d8bb8629914f1c8
                                                                                                                                                                      • Instruction Fuzzy Hash: 58627DB0E002059BDB18CF59C594BAEBBF1BF88308F2581ADD815AB352D735DA46CF94
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00ACD070 Relevance: .4, Instructions: 430COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 2ed1add8d1b294c2dd3a1cf73d1d69aa75d3a3c7144385a1a77b25b8a66410de
                                                                                                                                                                      • Instruction ID: 3e9f2b482a7f710d33d256577ef24cacbc2ac803895b5130e495acf91cf294f2
                                                                                                                                                                      • Opcode Fuzzy Hash: 2ed1add8d1b294c2dd3a1cf73d1d69aa75d3a3c7144385a1a77b25b8a66410de
                                                                                                                                                                      • Instruction Fuzzy Hash: 84F15B729042828FDB158F38C4817EDFFB2EF65300F2986BEC4A697382D2399945C791
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A42050 Relevance: .2, Instructions: 203COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID:
                                                                                                                                                                      • String ID:
                                                                                                                                                                      • API String ID:
                                                                                                                                                                      • Opcode ID: 562c10f9700530d07e6ed5bfa59ccd557b2d0deee001f43d3910a3d51761195c
                                                                                                                                                                      • Instruction ID: bd0c1f4db162146fcc4d65de1c4e34ae50f9c57889f516ee9b997f8b1464e6c3
                                                                                                                                                                      • Opcode Fuzzy Hash: 562c10f9700530d07e6ed5bfa59ccd557b2d0deee001f43d3910a3d51761195c
                                                                                                                                                                      • Instruction Fuzzy Hash: 498102799042869FDB01CFA8C4517EEFFF1AF9A300F584299E9946B782C3758545C7E0
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%

                                                                                                                                                                      Function 00A48080 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 318COMMON
                                                                                                                                                                      Download Yara Rule
                                                                                                                                                                      APIs
                                                                                                                                                                      • ___std_exception_copy.LIBVCRUNTIME ref: 00A4844D
                                                                                                                                                                      Strings
                                                                                                                                                                      Memory Dump Source
                                                                                                                                                                      • Source File: 00000000.00000002.2076238508.0000000000A41000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A40000, based on PE: true
                                                                                                                                                                      • Associated: 00000000.00000002.2075942504.0000000000A40000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2076238508.0000000000B73000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2077813674.0000000000B77000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000B8A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000D13000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000DF6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E33000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E3F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2078183383.0000000000E4D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2082581809.0000000000E4E000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084152519.0000000001003000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      • Associated: 00000000.00000002.2084399291.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                      Joe Sandbox IDA Plugin
                                                                                                                                                                      • Snapshot File: hcaresult_0_2_a40000_SecuriteInfo.jbxd
                                                                                                                                                                      Similarity
                                                                                                                                                                      • API ID: ___std_exception_copy
                                                                                                                                                                      • String ID: parse error$ror
                                                                                                                                                                      • API String ID: 2659868963-4201802366
                                                                                                                                                                      • Opcode ID: f87af3458eea461fcfa9e723db2e1d87475f44d67b0a689398a35836061a274b
                                                                                                                                                                      • Instruction ID: fe9afdb3f72c8e583c9dcf207d42ea628c6395b3798d37a3d588ab8a02403a1a
                                                                                                                                                                      • Opcode Fuzzy Hash: f87af3458eea461fcfa9e723db2e1d87475f44d67b0a689398a35836061a274b
                                                                                                                                                                      • Instruction Fuzzy Hash: CBC10971D10649CFEB09CF68DC857ADBBB1BF95304F148348E404AB692DBB8A6C5CB91
                                                                                                                                                                      Uniqueness

                                                                                                                                                                      Uniqueness Score: -1.00%